A design studio must store a vendor license key encrypted at rest, and the key must not be rotated. The application can read a parameter when it starts. Which store meets both requirements?
Select an answer to reveal the explanation.
Short Explanation
A license key is a stamp you must keep locked and unchanged, not a stamp you recut on a schedule. You store it as a Parameter Store SecureString so it is encrypted at rest and nothing rotates it. A rotation function would change the key the vendor told you to keep, and a plaintext parameter is not encrypted.
Full Explanation
The requirements are encryption at rest and a value that must not change. A Parameter Store SecureString is encrypted with a KMS key, and Parameter Store does not attach a rotation workflow to it, so the license key stays as stored. Secrets Manager can store a secret, but a rotation function on a schedule replaces that secret with a new value, which violates the requirement that this key must not be rotated. A standard String parameter is plaintext. It can be read at startup, but it does not meet encryption at rest. An environment variable in the task definition is available to anyone who can describe the task, and it is not the encrypted parameter this application is set up to read. Caveat: the application role needs permission to read the parameter, and it needs decrypt permission when a customer managed key encrypts the SecureString. Operational check: read the parameter with decryption from a test role, confirm the value matches the license key, and confirm no rotation is configured.