MLA-C01 Practice Question 70: Secrets Manager Credentials
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 7 · question 10 of 10
A SageMaker AI processing job extracts training data from an Amazon RDS for PostgreSQL database. A security scan found the database password hardcoded in the processing script, which is committed to the team's Git repository. The security team requires the password to be removed from all code and configuration, kept encrypted, retrieved only when the job runs, and rotated on a schedule.
What should the ML engineer do?
Show answer and explanation
Answer:
AWS Secrets Manager stores, retrieves, and rotates database credentials throughout their life. It replaces hardcoded credentials in source code with a runtime call that fetches the secret when it is needed. The processing job's execution role gets permission to read that one secret, the secret is encrypted with AWS KMS, and scheduled rotation changes the password without touching any code (option B).
- A is wrong because environment variables are part of the job's configuration. They are visible to anyone who can describe the job, which the requirement forbids, and they do not rotate. - C is wrong because a file in S3 is not a secrets store. It has no rotation, and anyone who can read the bucket can read the password. - D is wrong because the password is still stored in plaintext alongside the code, just in a file Git ignores. It still has to reach the job somehow, it cannot rotate, and it is easy to commit by accident.
Reference: What is AWS Secrets Manager?