A CloudFormation template parameter Default embeds the production webhook signing secret in version control. How should the team supply that secret instead?
Select an answer to reveal the explanation.
Short Explanation
A Default= in CloudFormation is still a commit. Yank production webhook secrets out of the template and pull them with dynamic references to Secrets Manager or SSM when the stack deploys.
Full Explanation
CloudFormation dynamic references resolve Secrets Manager or SSM SecureString values at deployment without committing plaintext secrets. NoEcho hides console display but does not erase secrets already in Git via Default. Public READMEs and hex encoding are not confidential storage.