Municipal microservices each need database credentials, and instances must stay interchangeable as Auto Scaling replaces them. How should secrets be supplied?
Select an answer to reveal the explanation.
Short Explanation
Secrets Manager is the city key cabinet—new microservice desks check out the current key when they start, so you can swap desks freely. Baking passwords into AMIs or images, or emailing them, glues secrets to machines you wanted to throw away.
Full Explanation
Municipal microservices should fetch database credentials at runtime from AWS Secrets Manager so Auto Scaling can replace instances freely without baking secrets into images. Each new interchangeable desk checks out the current secret on start (via IAM role), supports rotation, and never carries a stale password burned into an AMI. That runtime retrieval pattern keeps credentials out of artifacts and matches disposable compute.
Baking encrypted passwords into each AMI fails by concept because secrets become coupled to machine images—rotation requires new AMIs, every launch carries a copy, and interchangeability suffers. Emailing operators the shared password whenever Auto Scaling launches a task fails because it is a manual, insecure, non-scalable distribution workflow that cannot keep up with fleet churn. Hard-coding secrets in environment variables inside container images committed to the registry fails because the registry and image history become a secret store, violating least privilege and making rotation a rebuild-and-redeploy event.
Exam caveat: Prefer Secrets Manager or Parameter Store (SecureString) with runtime retrieval and IAM-based access for Auto Scaling / containers. Anything baked into AMIs, images, or human email is a distractor when the stem stresses interchangeable instances.
Operational check: Confirm task/instance roles can GetSecretValue only for needed secrets, rotation is enabled where appropriate, applications refresh after rotation, and image builds contain no plaintext credentials. If new instances still need a human to paste a password, the design is not automated.