A CloudFormation template parameter Default embeds the production webhook signing secret in version control. How should the team supply that secret instead?
Select an answer to reveal the explanation.
Short Explanation
A Default= in CloudFormation is still a commit. Yank production webhook secrets out of the template and pull them with dynamic references to Secrets Manager or SSM when the stack deploys.
Full Explanation
CloudFormation parameter Default values that embed production webhook signing secrets place those secrets into version control. The team should remove plaintext defaults and supply the value via dynamic references to Secrets Manager or SSM SecureString at deploy time. Dynamic references resolve confidential values during deployment without committing them into the municipal template history, which is the DVA-aligned pattern for IaC secrets.
Keeping the Default and marking NoEcho fails because NoEcho only hides console display; it does not erase secrets already committed via Default. Moving the secret into a public README fails conceptually by publishing it to every deployer and browser of the repo docs. Encoding the secret as hex in Default and documenting decoding in the Description fails because encoding is not encryption and still commits the material.
Exam caveat: rotate any webhook secret that was previously committed; fixing the template alone leaves historical Git exposure. Operational check: delete plaintext Defaults, wire {{resolve:secretsmanager:...}} or SSM dynamic references, redeploy to a test stack, and confirm the live webhook verifier receives the secret without template plaintext.