Question

A DevOps team manages an RDS instance using CloudFormation. Company policy prohibits storing database passwords in template parameters, plaintext, or version control. The password is already stored in AWS Secrets Manager under the secret name 'prod/rds/master'. The team wants CloudFormation to inject the password into the RDS instance's MasterUserPassword property at deploy time without ever exposing the value in the template, change set, or stack events. Which approach meets these requirements?

Accepted Answer

Use a dynamic reference in the MasterUserPassword property with the syntax '{{resolve:secretsmanager:prod/rds/master:SecretString:password}}'.

Answer

Add a NoEcho parameter for the password and pass the Secrets Manager value into it via the deployment pipeline at stack creation.

Answer

Reference the secret using an SSM dynamic reference '{{resolve:ssm-secure:prod/rds/master}}' so the value stays encrypted.

Answer

Use a Lambda-backed custom resource that calls GetSecretValue and returns the password as a resource attribute for MasterUserPassword.