A platform team manages CloudFormation and Terraform for 40 microservices that need database passwords and API tokens injected at deploy time, requires automatic rotation every 30 days, fine-grained IAM per secret, and no plaintext values in Git or state files. Which secrets handling approach for infrastructure code meets these governance needs?
Select an answer to reveal the explanation.
Short Explanation
You need passwords and tokens that rotate automatically without landing in Git or state files. Secrets Manager supports deploy-time references, scheduled rotation, and per-secret IAM so each service can be limited to its own secrets.
Full Explanation
CloudFormation dynamic references resolve AWS Secrets Manager values at deploy time, keeping database passwords and API tokens out of Git and templates. Terraform must use ephemeral or write-only references, or runtime retrieval, to keep values out of state; KMS encryption and per-secret IAM policies can isolate each of the 40 microservices to its own secrets, while native Lambda-backed rotation enforces the 30-day schedule without code changes. SSM Parameter Store SecureString can provide KMS encryption, per-secret IAM, and deploy-time injection, but it has no built-in rotation engine, so strict 30-day rotation requires separate custom automation. A shared IAM role can support Secrets Manager dynamic references and scheduled rotation, but gives services access to secrets beyond their own and violates least privilege and fine-grained IAM governance. Terraform locals written to plaintext state outputs fail confidentiality: despite rotation and per-secret IAM, secrets persisted in terraform.tfstate or plan artifacts are exposed in plaintext. Exam caveat: distinguish encryption and NoEcho masking from true rotation and state protection; SecureString and KMS alone do not provide automatic rotation. Practical check: verify the Secrets Manager rotation schedule and last-rotated date, use the IAM policy simulator to test each service role's per-secret isolation, and scan repositories, plans, and state files for secret values.