A company needs to deploy AWS CloudFormation templates that configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager. Which…

Question

Options

• AUse a dynamic reference in the CloudFormation template to reference the database credentials in
• BUse encrypted parameters in the CloudFormation template.
• CUse SecureString parameters to reference Secrets Manager.
• DUse SecureString parameters encrypted by AWS KMS.

• A
  84% (32)
• B
  3% (1)
• C
  8% (3)
• D
  5% (2)

Explanation

Explanation

Option A is correct because AWS CloudFormation dynamic references (using the syntax {{resolve:secretsmanager:secret-name}}) allow templates to securely retrieve sensitive values like database credentials directly from AWS Secrets Manager at deployment time, without ever exposing the credentials in plaintext within the template itself - perfectly leveraging the existing KMS and Secrets Manager infrastructure the company already uses.

Why the distractors are wrong:

• B is incorrect because "encrypted parameters" is a vague term and doesn't specifically integrate with Secrets Manager, which the company already has in place.
• C is incorrect because SSM SecureString parameters belong to AWS Systems Manager Parameter Store, not Secrets Manager - these are two different services, and using them would bypass the existing Secrets Manager setup.
• D is also incorrect for the same reason as C - SSM SecureString parameters with KMS encryption are a Parameter Store feature, not a Secrets Manager integration.

Memory Tip: Think of {{resolve:secretsmanager:...}} as a "pull at deployment" mechanism - CloudFormation resolves the secret dynamically when the stack runs, so credentials never sit hardcoded in your template. When a question mentions both KMS and Secrets Manager already in use, always look for the dynamic reference solution.

No community discussion yet for this question.