What's changed: In-scope coverage (fix): added AWS WAF (L7 web protection; SQLi/XSS/rate-limit via IaC) to the Network Firewall block (closes an Axis-B textbook gap)
6.1Identity and Secrets Management
Understand authorization for pipelines and runtimes—IAM roles, temporary credentials, Secrets Manager/Parameter Store, and OIDC federation. Eliminate long-lived keys and run securely with least privilege.
DevOps automation wields powerful permissions. Avoid long-lived keys; operate safely with roles, temporary credentials, and secrets management.
6.1.1Authorization and secrets
- IAM roles + temporary credentials: services run via roles; never embed long-lived keys.
- Secrets Manager: store DB passwords/API keys with automatic rotation.
- Parameter Store (SecureString): centralize settings and light secrets (KMS-encrypted).
- OIDC federation: external CI (e.g., GitHub Actions) assumes roles without keys.
Common on DOP-C02: services use IAM roles + temporary credentials (no long-lived keys), secrets needing rotation = Secrets Manager, settings/light secrets = Parameter Store (SecureString), keyless authz from external CI = OIDC federation. From GitHub Actions to AWS, assume a role via OIDC.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.