Transit-agency instances need a non-secret boot setting, the name of their log bucket, and that name changes without building a new image. Where should the name live?
Select an answer to reveal the explanation.
Short Explanation
Printing the log-bucket name on every machine's nameplate means a new nameplate for a new name. You put that non-secret setting in a Parameter Store standard String and let each instance read it at boot. Baking it into the AMI forces a new image, and rotation is the wrong tool for a value that is not a secret.
Full Explanation
A non-secret boot setting that changes on its own schedule belongs in a place instances can read at launch, not in an image. A Parameter Store standard String holds the bucket name, and each instance can read it when it boots, so a later edit is picked up without a new AMI. Baking the name into every AMI means the next change is a new image and a new launch. Secrets Manager with rotation is built to replace a secret on a schedule. The bucket name is not a secret, and rotating it would change a setting that should change only when an operator edits it. Hard-coding the name in user data that lives with a private AMI still ties the value to an image rebuild, which is the constraint the agency wants to avoid. Instances read the parameter at boot, so the launch template can keep a stable parameter name while only the value changes. Caveat: a standard String is not encrypted, which is acceptable here because the value is not a secret. Do not put a password in this parameter. Operational check: change the parameter, boot one instance, and confirm it uses the new bucket name without an AMI rebuild.