Instiq
Chapter 5 · Data Protection·v2.0.0·Updated 6/28/2026·~10 min

What's changed: Deepened SCS-C02 Chapter 5 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)

5.2Secrets Management and Encryption in Transit

Key points

Understand protecting credentials and traffic—Secrets Manager (auto-rotation), Parameter Store (SecureString), TLS/ACM, and certificate management. Handle secrets and traffic securely.

Protect data in transit, not just at rest. Manage secrets in dedicated services and encrypt traffic with TLS.

5.2.1Secrets and TLS

Diagram of secrets management and in-transit encryption: database passwords and API keys managed by Secrets Manager (KMS-encrypted, auto-rotation, Lambda integration); settings and light secrets by Parameter Store SecureString (KMS-encrypted); traffic encrypted with TLS; and public certificates issued and auto-renewed by ACM (AWS Certificate Manager) for ELB/CloudFront/API Gateway—protecting secrets and traffic.
Secrets and encryption in transit
  • Secrets Manager: KMS-encrypt DB passwords/API keys with automatic rotation.
  • Parameter Store (SecureString): centralize settings/light secrets, KMS-encrypted.
  • TLS: encrypt traffic to prevent eavesdropping/tampering (HTTPS).
  • ACM: issue and auto-renew public certificates for ELB/CloudFront/API Gateway.
Exam point

Common on SCS-C02: secrets needing rotation = Secrets Manager, settings/light secrets = Parameter Store (SecureString), in-transit encryption = TLS, certificate issuance/auto-renewal = ACM. ACM public certs are free and auto-renew for ELB/CloudFront, etc. (not directly exportable to EC2).

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in