What's changed: Deepened SCS-C02 Chapter 5 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
5.2Secrets Management and Encryption in Transit
Understand protecting credentials and traffic—Secrets Manager (auto-rotation), Parameter Store (SecureString), TLS/ACM, and certificate management. Handle secrets and traffic securely.
Protect data in transit, not just at rest. Manage secrets in dedicated services and encrypt traffic with TLS.
5.2.1Secrets and TLS
- Secrets Manager: KMS-encrypt DB passwords/API keys with automatic rotation.
- Parameter Store (SecureString): centralize settings/light secrets, KMS-encrypted.
- TLS: encrypt traffic to prevent eavesdropping/tampering (HTTPS).
- ACM: issue and auto-renew public certificates for ELB/CloudFront/API Gateway.
Common on SCS-C02: secrets needing rotation = Secrets Manager, settings/light secrets = Parameter Store (SecureString), in-transit encryption = TLS, certificate issuance/auto-renewal = ACM. ACM public certs are free and auto-renew for ELB/CloudFront, etc. (not directly exportable to EC2).
SCS-C02 secrets/in-transit protection probes "storing, distributing, and rotating secrets safely and encrypting traffic." Secrets Manager stores secrets KMS-encrypted, periodically updates DB credentials via automatic rotation (Lambda), and natively integrates with RDS/Redshift/DocumentDB; apps fetch via API/SDK rather than embedding in code. Parameter Store manages settings and light secrets hierarchically, with SecureString being KMS-encrypted (standard tier free; rotation is DIY); Secrets Manager can also be referenced from Parameter Store. In-transit encryption uses TLS (HTTPS/mutual TLS), with certificates issued and auto-renewed by ACM applied to ELB/CloudFront/API Gateway (ACM public certs cannot be exported to EC2—for termination on EC2, use ACM Private CA or a bring-your-own cert). ACM Private CA runs an internal private certificate hierarchy. For S3, the standard is to Deny aws:SecureTransport: false in the bucket policy to forbid HTTP and enforce TLS only. To handle secrets safely, on leak rotate rather than just remove from history, never log secrets, and restrict retrieval with least privilege. The key is to correctly choose Secrets Manager for rotation, Parameter Store for light secrets, TLS + ACM for transit (mind the attachment constraints), and TLS enforcement for S3.
| Use | Service | Key point |
|---|---|---|
| Secrets needing rotation | Secrets Manager | KMS-encrypted; Lambda rotation; RDS integration |
| Settings/light secrets | Parameter Store (SecureString) | KMS-encrypted; free standard; hierarchical |
| Encrypt traffic | TLS | HTTPS; enforce SecureTransport on S3 |
| Certificate management | ACM / ACM Private CA | Public free/auto-renew (not EC2); internal via Private CA |
Scenario: Don’t embed the RDS password in code, rotate it every 90 days, and allow API access only over HTTPS. → Store DB credentials in Secrets Manager (RDS integration + Lambda rotation every 90 days), fetched by the app at runtime. Apply an ACM certificate to ALB/CloudFront for TLS on public endpoints. For S3, Deny aws:SecureTransport: false in the bucket policy to forbid HTTP. Never log secrets, and restrict retrieval with least-privilege IAM.
FAQ: Secrets Manager or Parameter Store? For automatic rotation (DB credentials), native RDS integration, or cross-account sharing, use Secrets Manager (paid). For rotation-free settings or light secrets, Parameter Store SecureString suffices (standard tier free, KMS-encrypted). Choose by cost and features (especially rotation automation); the two can be combined.
Exam trap: Trying to install an ACM public certificate directly on EC2 is wrong—ACM public certs are not exportable and apply to ELB/CloudFront/API Gateway. To terminate TLS on EC2, use ACM Private CA or a bring-your-own cert. Also, baking secrets in plaintext into environment variables or an AMI is wrong—fetch them at runtime from Secrets Manager/Parameter Store.
5.2.2Section summary
- Secrets = Secrets Manager (rotation) / Parameter Store (SecureString)
- In transit = TLS + ACM (auto-renewing certs)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Securely manage a DB password with periodic automatic rotation. What?
Q2. Issue and auto-renew free public TLS certs for ELB/CloudFront. What?
Q3. Centrally manage settings/light secrets KMS-encrypted, referenced without hardcoding. Convenient option?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.