AWS Secrets & Certificate Management — Overview
Secrets management appears in 81+ questions across SCS-C03 (Data Protection) and SAP-C02/DOP-C02. The core decisions are: Secrets Manager vs Parameter Store (when to use which), automatic rotation patterns, ACM certificate management, and mTLS enforcement. This post covers all patterns exam questions test.
/aws/reference/secretsmanager/my-secret
Detailed Comparison
| Feature | Secrets Manager | Parameter Store |
|---|---|---|
| Rotation | Built-in with Lambda (native for RDS/Redshift/DocumentDB) | Not built-in (must implement yourself) |
| Cross-account | Yes (resource policy on secret) | No resource policy (must use cross-account IAM role) |
| Encryption | Always encrypted (KMS required) | Optional (String vs SecureString) |
| Size limit | 64 KB per secret | 4 KB (Standard) / 8 KB (Advanced) |
| Versioning | Automatic (AWSCURRENT, AWSPREVIOUS, AWSPENDING) | Labels on parameter versions |
| Throughput | 10,000 TPS | 1,000 TPS (Standard) / 10,000 (Advanced) |
| CloudFormation | Dynamic references resolve at deploy time | Dynamic references resolve at deploy time |
Secrets Rotation — How It Works
Secrets Manager rotation uses a Lambda function that executes 4 steps:
- createSecret: Generate new credentials, store as AWSPENDING version
- setSecret: Update the database/service with the new credentials
- testSecret: Verify the new credentials work (connect to DB)
- finishSecret: Move AWSPENDING → AWSCURRENT, old current → AWSPREVIOUS
Rotation Strategies
| Strategy | How | Downtime Risk |
|---|---|---|
| Single user | Change password of the same user | Brief — between password change and app refresh |
| Alternating users | Two users (user_1, user_2). Alternate which is active. | Zero — one user always works while the other is being rotated |
AWS Certificate Manager (ACM)
| Feature | ACM Public Certificates | ACM Private CA |
|---|---|---|
| Cost | Free | $400/month per CA + per-certificate fee |
| Validation | DNS or Email validation | No external validation needed |
| Renewal | Automatic (DNS-validated certs auto-renew) | Automatic (configurable validity) |
| Export private key | No (cannot export) | Yes (can export for on-premises use) |
| Use with | ELB, CloudFront, API Gateway, Amplify | ELB, CloudFront, API Gateway, EC2, on-premises, IoT |
| Use case | Public-facing HTTPS websites/APIs | Internal services, mTLS, IoT devices, code signing |
mTLS (Mutual TLS) Patterns
- API Gateway + mTLS: Configure custom domain with mutual TLS. Upload truststore (CA bundle) to S3. Clients present certificate signed by your CA.
- ALB + mTLS: ALB verifies client certificates. Configure trust store with your CA. Supports certificate revocation (CRL/OCSP).
- Service Mesh (App Mesh): Envoy proxies handle mTLS between microservices automatically. ACM Private CA issues short-lived certificates.
- Exam note: “Verify client identity at API level” → mTLS. “Verify client identity at network level” → VPN with certificate auth.
Integration Patterns
- RDS + Secrets Manager: Native rotation for MySQL, PostgreSQL, Oracle, SQL Server, MariaDB. Secrets Manager auto-manages the DB password.
- Lambda + Secrets Manager: Cache secrets using AWS Parameters and Secrets Lambda Extension (reduces API calls, adds caching layer).
- ECS + Secrets Manager: Reference secrets in task definition as environment variables. ECS agent fetches at container start.
- CloudFormation + Secrets Manager: Generate random password at deploy:
{{resolve:secretsmanager:my-secret:SecretString:password}} - CodePipeline/CodeBuild: Reference Parameter Store/Secrets Manager for build secrets. Never hardcode in buildspec.
Exam Tips
| Exam | Key Points |
|---|---|
| SCS-C03 | “Automatic rotation of DB credentials” → Secrets Manager. “Free config storage” → Parameter Store (Standard). “Cross-account secret access” → Secrets Manager resource policy. “mTLS for API” → API Gateway custom domain + truststore. “Internal certificates for microservices” → ACM Private CA. “Cannot export private key” → ACM Public (use Private CA if export needed). “Alternating users” = zero-downtime rotation. |
AWS Certification Exam Practice Questions
Question 1:
A company’s application connects to an RDS MySQL database using hardcoded credentials in the application configuration file. The security team requires automatic credential rotation every 30 days without application downtime. Which solution meets these requirements with the LEAST development effort?
- Store credentials in SSM Parameter Store SecureString, write a Lambda function to rotate the DB password and update the parameter every 30 days
- Enable Secrets Manager with native RDS rotation using the alternating users strategy, update application to retrieve credentials from Secrets Manager at runtime
- Use IAM database authentication instead of passwords
- Store credentials in a KMS-encrypted S3 file, rotate manually every 30 days
Show Answer
Answer: B — Secrets Manager provides native RDS rotation with pre-built Lambda functions for MySQL (zero development effort for the rotation logic). Alternating users strategy ensures zero downtime — one user is always valid while the other rotates. The application calls Secrets Manager API at startup/periodically to get current credentials. Parameter Store (A) requires you to write the rotation Lambda yourself. IAM auth (C) has connection limits and doesn’t work for all DB engines/configurations.
Question 2:
Multiple AWS accounts in an Organization need to access a shared database credential stored in a central security account. The credential must be accessible without creating IAM users or access keys in the security account. Which approach enables this?
- Store in Parameter Store and share via RAM
- Store in Secrets Manager and add a resource policy allowing the member accounts’ roles to retrieve it
- Replicate the secret to each account using Secrets Manager multi-Region replication
- Store in S3 with a bucket policy allowing cross-account access
Show Answer
Answer: B — Secrets Manager supports resource policies (like S3 bucket policies). Add a policy allowing specific IAM roles in member accounts to call secretsmanager:GetSecretValue. The member account role assumes its own role and directly accesses the secret cross-account — no credentials needed in the security account. Parameter Store (A) doesn’t support resource policies or RAM sharing. Multi-region replication (C) is for HA, not cross-account sharing.
Question 3:
A company needs to issue short-lived certificates for internal microservices running on ECS. The certificates must be automatically rotated, and the private keys must be exportable so the application can use them directly. Public CAs should NOT be involved. Which service provides this?
- ACM public certificates with auto-renewal
- ACM Private CA issuing short-lived certificates (configured with 1-7 day validity)
- Self-signed certificates generated by a Lambda function
- Let’s Encrypt certificates with certbot automation
Show Answer
Answer: B — ACM Private CA creates your own internal CA. You can issue short-lived certificates (hours to days) for service-to-service mTLS. Private keys are exportable (unlike ACM public certificates). No public CA involved — fully private. Works with ECS, EKS, EC2, App Mesh. Self-signed (C) doesn’t provide centralized management or revocation. Let’s Encrypt (D) is public and has rate limits.
Question 4:
A security engineer discovers that application developers are storing database passwords in Lambda environment variables (visible in the console). They need a solution that encrypts secrets at rest, restricts access via IAM, and allows the Lambda function to retrieve the secret without code changes to the environment variable approach. Which solution achieves this?
- Encrypt environment variables using a KMS key and grant Lambda’s execution role kms:Decrypt
- Store secrets in Secrets Manager, reference them in Lambda environment variables using dynamic resolution
- Use the AWS Parameters and Secrets Lambda Extension to cache Secrets Manager values, update code to read from extension cache
- Store secrets in S3 encrypted with KMS, have Lambda download at startup
Show Answer
Answer: A — Lambda environment variables can be encrypted with a KMS key. The values appear encrypted in the console (not visible). The Lambda execution role needs kms:Decrypt permission. At runtime, Lambda automatically decrypts the environment variables — no code changes needed. This is the “without code changes” approach. Secrets Manager (B, C) is better long-term but requires code changes. The extension (C) requires reading from a different source.
Question 5:
A company requires that their API Gateway verifies the identity of each calling client using certificates (not just API keys or tokens). Clients must present a certificate issued by the company’s internal CA. How should this be configured?
- Configure API Gateway with a Lambda authorizer that validates certificate headers
- Configure a custom domain on API Gateway with mutual TLS enabled, upload the company’s CA certificate bundle as a truststore to S3
- Put CloudFront in front of API Gateway and configure CloudFront to validate client certificates
- Configure a VPN connection and require VPN client certificates
Show Answer
Answer: B — API Gateway supports mutual TLS (mTLS) on custom domains. Upload your CA bundle (truststore) to S3, reference it in the custom domain configuration. API Gateway will verify that each client presents a valid certificate signed by your CA. No additional authentication layer needed. CloudFront (C) doesn’t natively validate client certificates for API Gateway origins. Lambda authorizer (A) would need custom certificate parsing logic.
Related Posts
- Data Encryption Architecture (KMS & CloudHSM)
- IAM Security Architecture
- Incident Response Architecture
- CI/CD Pipeline Architecture
References
- AWS Secrets Manager User Guide
- SSM Parameter Store Guide
- ACM Private CA User Guide
- mTLS for API Gateway — AWS Security Blog
Frequently Asked Questions
When should I use Secrets Manager vs Parameter Store?
Use Secrets Manager when you need: automatic rotation (especially for RDS), cross-account access (resource policy), or built-in password generation. Use Parameter Store for: configuration values (not secrets), feature flags, when cost matters (free tier), or when you need hierarchical paths. You can reference Secrets Manager secrets from Parameter Store paths for compatibility.
How does Secrets Manager rotation work without downtime?
Use the alternating users strategy: create two DB users (user_1, user_2). Secrets Manager rotates one at a time. While user_1’s password is being changed, user_2 still works. Applications that cache credentials continue working with the previous valid user until they refresh. The AWSPREVIOUS version remains valid during the rotation window.
Can I use ACM certificates on EC2 instances?
ACM public certificates cannot be exported (no private key access), so they can’t be installed directly on EC2. They work only with integrated services (ELB, CloudFront, API Gateway). ACM Private CA certificates CAN be exported and installed on EC2, on-premises servers, IoT devices, or anywhere you need the private key.