Exam AWS Certified Developer - Associate DVA-C02 topic 1 question 196 discussion

The correct answer is (C). Solution (C) is the best option because: It's the most secure solution: Sensitive data is stored in AWS Systems Manager Parameter Store, which is a secret management service managed by AWS. Secure string parameters in AWS Systems Manager Parameter Store are encrypted with an AWS KMS key. It's integrated with CloudFormation: Secure string parameters can be referenced in CloudFormation templates using dynamic references. This means that sensitive data does not need to be stored in CloudFormation code.

C is the correct answer.

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html

AWS Systems Manager Parameter Store is a secure and scalable solution for storing configuration data, including sensitive information. In this case, using a secure string parameter allows you to store the sensitive data in Parameter Store in an encrypted form. Option C is the most secure because it leverages AWS Systems Manager Parameter Store's capabilities for securely storing sensitive data, and dynamic references allow you to directly reference the parameter values in CloudFormation templates. This approach avoids exposing sensitive data in the templates themselves and provides a central and secure storage solution for sensitive configuration information.

A option leverages CloudFormation parameters, which can securely store sensitive data. By using an AWS KMS key to encrypt the CloudFormation templates, you ensure that the sensitive data is protected. It follows the principle of least privilege and provides secure access to sensitive information directly within CloudFormation. Option B is less secure because it involves storing sensitive data in an S3 bucket, which could be compromised. Option C suggests using AWS Systems Manager Parameter Store, which is secure, but using CloudFormation parameters and KMS keys provides an integrated solution directly within CloudFormation. Option D involves Amazon EFS, which is typically used for file storage and is not designed for securely storing sensitive data directly within CloudFormation.

C is the correct choice. Parameter Store's secure string parameter encrypts the data using AWS KMS