A SysOps administrator is helping a development team deploy an application to AWS. The AWS CloudFormation template includes an Amazon Linux EC2 instance, an Amazon Aurora DB cluster, and a hardcoded…

Question

Options

• AUse the AWS::SecretsManager::Secret resource with the GenerateSecretString property to
• BUse the AWS::SecretsManager::Secret resource with the SecretString property Accept a
• CUse the AWS::SSM::Parameter resource. Accept input as a CloudFormation parameter to store
• DUse the AWS::SSM::Parameter resource. Accept input as a CloudFormation parameter to store

• A
  75% (12)
• B
  13% (2)
• C
  6% (1)
• D
  6% (1)

Explanation

Option A is correct because AWS::SecretsManager::Secret with GenerateSecretString automatically generates a cryptographically secure password at stack creation time - meaning the plaintext password never appears in the template or CloudFormation parameters - and Secrets Manager natively supports automatic rotation via Lambda, making the 90-day rotation requirement straightforward to enforce.

Option B is weaker because SecretString requires you to supply the actual password value (hardcoded or via parameter), defeating the purpose of secret generation and potentially exposing it in CloudFormation event history or the console.

Options C and D use SSM Parameter Store, which can store secrets as SecureString but lacks Secrets Manager's built-in rotation scheduling and RDS/Aurora integration; you'd have to build rotation logic manually, and accepting the password as a CloudFormation parameter risks exposing it in stack events.

Memory tip: Think of it this way - Secrets Manager = Generates + Rotates automatically. Whenever a question mentions a rotation requirement (30/60/90 days), Secrets Manager with GenerateSecretString is almost always the answer, since SSM Parameter Store requires you to "bring your own rotation."

No community discussion yet for this question.