A company deploys a new application to Amazon EC2 instances. The application code is stored in an AWS CodeCommit repository. The company uses an AWS CodePipeline pipeline to deploy the code to the…

Question

Options

• AStore the values in AWS Secrets Manager. Update the code to retrieve these values when the
• BStore the values in AWS Systems Manager Parameter Store as secret strings. Update the code
• CStore the values in an AWS Lambda function. Update the code to invoke the Lambda function
• DStore the configuration information in a file on the EC2 instances. Ensure that the underlying
• EStore the values in a text file in an Amazon S3 bucket. In the CI/CD pipeline, copy the file to the

• A
  73% (19)
• C
  15% (4)
• D
  8% (2)
• E
  4% (1)

Explanation

Options A and B are correct because AWS Secrets Manager and AWS Systems Manager Parameter Store (with SecureString type) are purpose-built services for storing sensitive credentials. Both encrypt values at rest using AWS KMS, integrate with IAM for fine-grained access control, and allow applications to retrieve secrets programmatically at runtime - keeping credentials out of source code and configuration files entirely.

Why the distractors fail:

• C (Lambda) - Lambda is a compute service, not a secrets store. Embedding secrets inside a Lambda function just shifts the problem; the function itself would need secure storage, and this adds unnecessary complexity and attack surface.
• D (file on EC2) - Storing credentials in a flat file on the instance is dangerous: files can be exposed through misconfigured permissions, AMI snapshots, or instance compromise. There's no encryption, rotation, or audit trail.
• E (S3 text file) - Plaintext credentials in S3 are only as safe as the bucket policy. Even with proper ACLs, secrets in plaintext files lack automatic rotation, versioning audit trails, and the access control granularity that Secrets Manager and Parameter Store provide. Copying secrets through a CI/CD pipeline also exposes them in pipeline logs.

Memory tip: Think "secrets belong in secrets services." AWS gives you two dedicated options - Secrets Manager (with built-in rotation) and SSM Parameter Store SecureString (KMS-encrypted, lower cost). If an answer stores credentials in compute, storage objects, or flat files, it's wrong - secrets should never be at rest in plaintext outside a managed secrets service.

No community discussion yet for this question.