Where should application secrets be stored on AWS?
- A Secrets Manager or Parameter Store, retrieved at runtime via an IAM role
- B Environment variables in the repository
- C Baked into the AMI
- D In the application source code
Answer
Secrets Manager or Parameter Store, retrieved at runtime via an IAM role
Secrets Manager supports automatic rotation. Retrieving via an IAM role means no long-lived credential exists to leak.





