Question

A CloudOps engineer is deploying an application to a fleet of EC2 instances using a CloudFormation template. The application needs to retrieve a database password at boot time. The security team requires that the password be encrypted at rest, never appear in the CloudFormation template or stack parameters in plaintext, and be retrievable by the instances' IAM role. The team wants to avoid additional per-secret charges and does not need automatic secret rotation. Which approach best meets these requirements?

Accepted Answer

Store the password as a SecureString parameter in AWS Systems Manager Parameter Store, grant the instance role ssm:GetParameter and kms:Decrypt permissions, and retrieve it in the user data script.

Answer

Store the password in AWS Secrets Manager, enable automatic rotation, and reference it directly as a CloudFormation stack parameter.

Answer

Pass the password as a CloudFormation parameter with NoEcho set to true so it is hidden in the console.

Answer

Store the password as a standard String parameter in Parameter Store and restrict access using an IAM policy on the parameter path.