2.3 - Configuration and API protection (Parameter Store, WAF)
AWS Certified Developer Associate objective 2.3 covers managing configuration and protecting APIs. To store many hierarchical configuration values, such as /app/prod/db-host, SSM Parameter Store supports hierarchical paths so you can organise and fetch parameters by prefix and apply IAM per path. When a team needs larger parameter values or parameter policies such as expiration, the Parameter Store advanced tier provides them beyond the standard tier limits. To protect a public REST API on API Gateway against common exploits like SQL injection and cross-site scripting, AWS WAF with managed rule groups filters malicious requests using AWS-maintained rule sets. You should also know SecureString parameters, throttling and usage plans. Expect scenario questions that describe organising hierarchical config, needing larger parameters or policies, or shielding a public API from web exploits, and ask which service or tier - Parameter Store paths, the advanced tier, or WAF managed rules - applies.
Many hierarchical config values (/app/prod/...) = Parameter Store hierarchical paths. Larger values or parameter policies = advanced tier. Protect a public API from SQLi/XSS = WAF managed rule groups.
Practice questions
1. A Lambda function in a VPC must call KMS and DynamoDB privately, without internet access. What enables this?
- An internet gateway on the subnet
- A public IP on the function
- VPC endpoints for the services (correct answer)
- A larger function memory setting
Interface VPC endpoints (PrivateLink) for KMS and a gateway endpoint for DynamoDB let a VPC-attached Lambda reach these services over the private AWS network without an internet path.
2. Which service lets a developer store simple configuration values, and optionally encrypted strings, for retrieval by applications at low cost?
- Amazon S3 storing a configuration JSON file
- AWS KMS customer managed keys
- AWS Systems Manager Parameter Store (correct answer)
- Amazon RDS configuration tables
Parameter Store keeps configuration as parameters, including SecureString values encrypted with KMS, retrievable via the SDK. Standard parameters are free, making it a low-cost config store.
3. A developer needs an S3 object encrypted so that AWS manages the keys with no key configuration and no extra cost. Which server-side option fits?
- SSE-S3 with Amazon S3 managed keys (correct answer)
- SSE-C where the client supplies the key
- SSE-KMS with a customer managed key
- Client-side encryption before the upload
SSE-S3 encrypts objects with keys fully managed by S3 (AES-256), with no key setup and no additional charge. SSE-KMS adds auditing and access control via KMS keys but has KMS costs and configuration.
4. A developer stores an RDS password in Secrets Manager and wants it rotated automatically every 30 days. What performs the rotation?
- A rotation Lambda invoked on the schedule (correct answer)
- A CloudTrail trail replaying the old secret
- An S3 lifecycle rule expiring the secret
- A DynamoDB TTL removing the old version
Secrets Manager rotation uses a Lambda function (provided for RDS or custom) that Secrets Manager invokes on the configured schedule to create a new secret version and update the database credential.
5. A developer wants EC2 application code to obtain AWS credentials without embedding any keys. What is the recommended approach?
- Attach an IAM role via an instance profile (correct answer)
- Store an access key in the user data script
- Write access keys to a file in the AMI
- Pass keys as environment variables at boot
An IAM role attached through an instance profile provides temporary, automatically rotated credentials retrievable from the instance metadata service, eliminating stored keys. Embedding keys in user data or the AMI is a security risk.
6. A developer must store many hierarchical configuration values (e.g., /app/dev/db/url) and fetch them by path prefix cheaply. Which service is designed for this?
- AWS Secrets Manager with automatic rotation
- Amazon DynamoDB with a composite primary key
- SSM Parameter Store with hierarchical paths (correct answer)
- Amazon S3 with a folder-like key structure
Parameter Store organizes parameters in hierarchical paths and supports GetParametersByPath to fetch a whole subtree, with a free standard tier. Secrets Manager is better when automatic rotation of secrets is the priority.