Database passwords for a transit fare system still sit in SSM Parameter Store as plaintext String parameters. Which secrets-store improvement is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Plaintext parameters are sticky notes on the terminal—fine for non-secrets, terrible for fare-system passwords. Secrets Manager (or properly locked SecureString) plus rotation keeps the credential off the glass and on a schedule. Renaming the parameter does not encrypt it.
Full Explanation
Improving secrets storage replaces plaintext Parameter Store String values with Secrets Manager or encrypted SecureString parameters under least-privilege IAM, ideally with automatic rotation for database credentials. Cosmetic renaming, dashboard exposure, and shared cross-environment passwords increase risk. Continuous improvement of existing solutions should treat secret classification, encryption, access, and rotation as one remediation.