Where should a database password for a pipeline be stored?
Why B is the answer
AWS Secrets Manager
Secrets Manager stores and rotates secrets.
In detail
- Secrets Manager stores and rotates passwords.
- Rotation can be automated.
Use case
An illustrative scenario, not a real incident.
A pipeline reads its database password from Secrets Manager, so no code holds it.
See it in different ways
mindmap
root((Data security))
Identity
IAM roles
Secrets Manager
Fine-grained access
Lake Formation
Column grants
Encryption
SSE-KMS
Discovery
Macie
Audit
CloudTrailsequenceDiagram participant P0 as Glue job participant P1 as Secrets Manager participant P2 as Database P0->>P1: Get secret P1-->>P0: Password P0->>P2: Connect
Key point: Secrets Manager stores and rotates secrets.
Why the other options are wrong
- A. A code comment
- A comment exposes it.
- C. A plain text file in S3
- Plain text exposes it.
- D. An environment variable in the job
- A variable still exposes it.