A parks reservation API currently stores database passwords in plaintext environment variables on its hosts. Which design best improves credential security?
Select an answer to reveal the explanation.
Short Explanation
Passwords taped to the monitor are fine—until someone walks by with a camera. Secrets Manager (or SecureString parameters) keeps DB credentials vaulted, IAM-gated, and rotatable instead of living in plaintext env vars. Git commits and laminated badges are just more sticky notes.
Full Explanation
Central secret stores such as AWS Secrets Manager and SSM Parameter Store SecureString parameters keep credentials out of plaintext environment variables and source control. Applications obtain secrets at runtime using IAM roles, and Secrets Manager can automate rotation for supported database engines. Hard-coding, committing, or physically distributing passwords expands exposure and complicates rotation after staff changes.