Question

A SysOps administrator manages a fleet of EC2 instances running a web application that connects to an RDS database. Currently, the database password is hardcoded in the application configuration files baked into the AMI. Security requires that credentials be stored centrally, encrypted at rest with a customer-managed KMS key, and retrievable by the application at runtime without embedding the value in the AMI or user data. The team wants the simplest AWS-native solution with no additional licensing cost. Which approach should the administrator implement?

Accepted Answer

Store the password as a SecureString parameter in AWS Systems Manager Parameter Store using a customer-managed KMS key, and grant the instance role permission to read the parameter and decrypt it.

Answer

Store the password in AWS Secrets Manager with automatic rotation enabled, and configure the instances to retrieve it using the Secrets Manager API.

Answer

Store the password as a String parameter in Parameter Store and rely on IAM policies alone to restrict access to the parameter.

Answer

Store the password in an encrypted S3 object using SSE-KMS and have the application download it at startup with an instance role.