5.4 - Protecting credentials and secrets (Secrets Manager, Parameter Store, CloudHSM, access keys)

1. A database password used by an application must be rotated every thirty days without any code change. Which service fits best?

• AWS Systems Manager Parameter Store with a SecureString parameter and a scheduled maintenance window to overwrite it
• AWS Secrets Manager (correct answer)
• Amazon S3 with an encrypted object holding the credentials, refreshed by a scheduled job that also updates the database
• AWS AppConfig with a hosted configuration profile whose new version is deployed on the schedule you configure

Secrets Manager is the only one with native managed rotation: it runs a Lambda that changes the password on the database and stores the new value atomically, with staging labels so in flight clients are not broken. The other three merely store or deliver a value and would require you to build and maintain the whole rotation workflow yourself.

2. S3 Object Lock is enabled in compliance mode with a five year retention on a bucket. What can the account root user do to an object under retention?

• Delete it, since the root user is exempt from every bucket level control by design of the account hierarchy
• Shorten the retention period after opening a support case that documents the business reason for the change
• Nothing: the version cannot be deleted or overwritten until the retention period expires (correct answer)
• Move it to Glacier Deep Archive, which resets the retention clock to the date of the storage class transition

Compliance mode binds everyone including the root user, and no support path exists to shorten or remove the retention, which is exactly what makes it acceptable to regulators. Governance mode is the variant that allows a privileged bypass, and a lifecycle transition changes the storage class without touching the retention date.

3. A regulated workload requires cryptographic operations inside a hardware module the customer controls exclusively, with FIPS 140-2 Level 3 validation. Which service should be used?

• AWS Secrets Manager, storing the private keys as secrets and rotating them on a schedule defined by the compliance team
• AWS Systems Manager Parameter Store with SecureString parameters backed by a customer managed KMS key in the account
• AWS Certificate Manager, which holds the private key of each issued certificate without ever exposing it to an operator
• AWS CloudHSM (correct answer)

CloudHSM gives single tenant hardware security modules that you alone administer, which is what exclusive control plus Level 3 validation demands. Secrets Manager and Parameter Store store values in software backed by KMS, and ACM manages certificate keys but offers neither dedicated hardware nor customer held HSM credentials.

4. Which S3 capability moves objects to cheaper storage classes and expires them automatically according to their age?

• Lifecycle configuration rules (correct answer)
• Storage Lens dashboards, which surface usage and activity metrics across buckets and accounts for optimisation purposes
• Event notifications delivered to Lambda, which then decide what to do with the object based on its creation timestamp
• Multipart upload settings, which control how large objects are split and reassembled during a transfer to the bucket

Lifecycle rules are the native, server side mechanism for transitions and expirations, including on noncurrent versions and incomplete multipart uploads. Storage Lens only reports, event notifications react to individual writes rather than to age, and multipart settings concern how an upload is transferred.

5. How should an application on ECS retrieve a database password stored in Secrets Manager?

• By baking the secret value into the container image at build time so that no runtime call to the API is ever needed
• By reading it from an environment variable that the deployment pipeline populates with the plaintext value at release
• By downloading it once at first boot and writing it to a file on a shared volume that other tasks can also mount
• By referencing the secret in the task definition, so the task execution role fetches it at launch (correct answer)

ECS resolves a secret reference at task launch using the execution role, so the value never sits in the image, the pipeline or a shared volume. Baking it into an image spreads it to every registry copy, a pipeline populated variable exposes it in plain text, and a shared file survives the task and can be read by anything that mounts the volume.

6. A team must keep audit records for seven years and prevent anyone from shortening that period, while still allowing an authorised administrator to override in an emergency. Which configuration fits?

• A bucket policy that denies s3:DeleteObject to every principal except a named break glass role held by the security team
• A lifecycle rule with an expiration set to seven years, which prevents any earlier deletion of the stored objects
• Object Lock in governance mode with a seven year retention (correct answer)
• Object Lock in compliance mode with a seven year retention, plus a support case opened in advance for emergencies

Governance mode is precisely the variant that blocks everyone by default yet allows a principal holding s3:BypassGovernanceRetention to act, which matches the emergency requirement. Compliance mode admits no override at all, a lifecycle rule expires objects rather than protecting them, and a bucket policy can be edited by anyone able to edit bucket policies.