Exam AWS DevOps Engineer Professional topic 1 question 103 discussion

Combination of BCF will secure both secrets and sensitive data

Between C and D: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html

A - wrong - I even don't understand what the author wanted to do D - wrong - Rather than embedding sensitive information directly in your CloudFormation templates, we recommend you use dynamic parameters in the stack template to reference sensitive information that is stored and managed outside of CloudFormation, such as in the AWS Systems Manager Parameter Store or AWS Secrets Manager. E - wrong - having dynamic parameters we don't need encryption

F: NoEcho is not sufficient

The main thing to understand here is either Secrets Manager or SSM parameter store should be used to encrypt sensitive information. Usually for passwords or cert keys use Secrets Manager so that you can rotate the password or cert key periodically and for all other static sensitive data that doesn't need to change periodically use SSM parameter store.

BCF -- Correct D is wrong as it is simple string and C is secure string

BCF. Why somebody picks "D" instead of "C" ? C = secure strings, D = simple strings. "C" should be correct

Between C & D, Prefer C due to security concerns, C allows dynamic reference which doesn't store/sow password. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html

I'll go with B, C, F A) is not the use case D) insecure, you can still see the sensitive value E) encrypting the template do not prevent the echo and it is not effective

BDF makes most sense. KMS is not used for storing secrets. It's either Secrets Manager or Systems Manager.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html