DOP-C02 Practice Question 34: Dynamic Reference Secrets Manager
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 4 · question 4 of 10
A CloudFormation template provisions an Amazon RDS database and an Amazon ECS task definition that needs the database password. Today the password is a template parameter declared with NoEcho: true, and the deployment pipeline supplies it from a file in the source repository. Security now requires that the password never be stored in the repository and never be passed as a stack parameter, and that a stack update pick up the current value automatically after the secret rotates. The team does not want to write or maintain any code for this.
What should the team do?
Show answer and explanation
Answer:
Dynamic references exist for exactly this problem: they "provide a convenient way for you to specify external values stored and managed in other services and decouple sensitive information from your infrastructure-as-code templates", and "CloudFormation retrieves the value of the specified reference when necessary during stack and change set operations." Because the value is resolved at operation time rather than passed in, the password is never in the repository and never a stack parameter, and the next stack update picks up whatever Secrets Manager currently holds after rotation. The documentation specifically recommends Secrets Manager secrets or Parameter Store secure strings for sensitive data, and there is no code to maintain.
Option A only moves where the plaintext lives. The password still travels through the pipeline and still becomes a stack parameter value; NoEcho masks it in console and API output but does not remove it from the stack's parameters, and the stack does not follow rotation.
Option B stores a database password in plaintext. String is not SecureString, and the AWS::SSM::Parameter::Value<String> parameter types do not support SecureString at all, so this both fails the encryption requirement and still resolves through a stack parameter.
Option C is the custom code the team ruled out, and it is the worse pattern: a custom resource's returned values are visible through APIs that surface property values unless they are masked, and the documentation notes dynamic references cannot be used for secure values inside custom resources.
Reference: Get values stored in other services using dynamic references