A city's permit API should load the database password at runtime instead of hard-coding it in application source. Which AWS service is designed to store and retrieve that kind of secret?
Select an answer to reveal the explanation.
Short Explanation
Hard-coding a database password is like writing the vault combination on the office whiteboard. Secrets Manager keeps that password as a managed secret the app can fetch when it needs it — and you can rotate it without rewriting the code.
Full Explanation
AWS Secrets Manager is designed to store and retrieve secrets such as a database password that a city's permit API should load at runtime instead of hard-coding in application source. Hard-coding a password is like writing the vault combination on the office whiteboard; Secrets Manager keeps the secret managed so the app can fetch it when needed and rotate it without rewriting code. Amazon CloudFront is a CDN, not a secrets vault. AWS Snowball Edge moves data on devices; it is not the runtime secret store for an API. Amazon Route 53 is DNS. Distractors fail by substituting CDN, offline transfer, and DNS services for secret management. Exam caveat: grant the API's execution role least-privilege access to only the needed secret, enable encryption, and avoid placing the same password in plaintext environment variables or tickets. Operational check: migrate hard-coded DB passwords into Secrets Manager, update the permit API to retrieve at runtime, rotate the secret, confirm old passwords fail, restrict who can read secret values in IAM, and monitor secret access for anomalies. In practice, grant the permit API role secretsmanager:GetSecretValue on one secret ARN only, rotate on a cadence, and confirm application config no longer contains plaintext passwords.