Secrets, rotation and data masking

AWS Secrets Manager

Skill 5.3.1 is about getting passwords, API keys and tokens out of code and config files. Secrets Manager stores them encrypted with KMS, controls who reads them with IAM and resource policies, keeps versions, replicates them across Regions and, most importantly for the exam, rotates them.

$ aws secretsmanager create-secret --name prod/orders/db \
    --kms-key-id alias/secrets-prod \
    --secret-string '{"username":"app","password":"EXAMPLE-ONLY"}'

$ aws secretsmanager get-secret-value --secret-id prod/orders/db \
    --query SecretString --output text

# CloudFormation dynamic reference
MasterUserPassword: '{{resolve:secretsmanager:prod/orders/db:SecretString:password}}'

Rotating secrets

Rotation is the feature that makes Secrets Manager the answer instead of Parameter Store. The exam tests the strategy (single vs alternating users), the four Lambda steps, the schedule and, very often, why rotation fails in a private subnet.

$ aws secretsmanager rotate-secret --secret-id prod/orders/db \
    --rotation-lambda-arn arn:aws:lambda:us-east-1:111122223333:function:rds-pg-rotate \
    --rotation-rules '{"ScheduleExpression":"rate(30 days)","Duration":"3h"}' \
    --rotate-immediately

$ aws secretsmanager describe-secret --secret-id prod/orders/db \
    --query '{On:RotationEnabled,Next:NextRotationDate}'

Three ways to rotate, and the newest one

Secrets Manager now rotates secrets in three ways. Managed rotation: the owning service rotates for you (for example RDS ManageMasterUserPassword, Redshift), with no Lambda. Lambda rotation: your function (or an AWS template) runs create, set, test, finish. Managed external secrets (since November 2025): a secret type for third-party SaaS credentials such as Salesforce, Snowflake and BigID (more partners added in 2026). Rotation is done through the partner integration, so there is no rotation function to maintain and no extra charge beyond normal secret pricing. For a third-party key from a provider that isn’t a partner, you still write a custom rotation Lambda.

Parameter Store and choosing a store

Not every value is a secret that needs rotation. Systems Manager Parameter Store holds configuration and simple secrets cheaply, with KMS encryption for SecureString. The exam usually asks you to choose between the two stores, so learn the difference rather than every detail.

$ aws ssm put-parameter --name /orders/prod/api/key --type SecureString \
    --key-id alias/ssm-prod --value "EXAMPLE-ONLY"

$ aws ssm get-parameters-by-path --path /orders/prod --recursive \
    --with-decryption --query "Parameters[].Name"
[ "/orders/prod/api/key", "/orders/prod/db/host" ]

Masking sensitive data in CloudWatch Logs

Skill 5.3.4 is about data masking and sanitization. The most common leak is not a database but a log line: a developer prints a request and suddenly card numbers, emails and access keys are in CloudWatch Logs for everyone with read access. Data protection policies find and mask them as they arrive.

$ aws logs put-data-protection-policy --log-group-identifier /app/orders \
  --policy-document '{
  "Name": "orders-dp", "Version": "2021-06-01",
  "Statement": [
   {"Sid": "audit", "DataIdentifier": [
      "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
      "arn:aws:dataprotection::aws:data-identifier/AwsSecretKey"],
    "Operation": {"Audit": {"FindingsDestination": {}}}},
   {"Sid": "mask", "DataIdentifier": [
      "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
      "arn:aws:dataprotection::aws:data-identifier/AwsSecretKey"],
    "Operation": {"Deidentify": {"MaskConfig": {}}}}]}'

Masking messages and finding sensitive data

Logs are one channel. Messages between services and files in S3 are the others. The exam names SNS message data protection for messages and Amazon Macie for finding sensitive data in S3. For anything else, the answer is to sanitize in your own pipeline before the data is stored or shared.

Amazon Macie in one paragraph

Macie discovers sensitive data in S3. Automated sensitive data discovery samples objects across your buckets every day for broad visibility; sensitive data discovery jobs scan chosen buckets once or on a schedule for depth. It uses managed and custom data identifiers plus allow lists (values to ignore), produces sensitive data findings, and also reports bucket-level policy findings such as a bucket becoming public. Findings go to EventBridge and Security Hub for automated response.

$ aws macie2 create-custom-data-identifier --name employee-id \
    --regex 'EMP-[0-9]{6}' --keywords employee staff --maximum-match-distance 30

$ aws macie2 create-classification-job --name weekly-hr --job-type SCHEDULED \
    --schedule-frequency '{"weeklySchedule":{"dayOfWeek":"MONDAY"}}' \
    --custom-data-identifier-ids cdi-1234 \
    --s3-job-definition '{"bucketDefinitions":[{"accountId":"111122223333",
       "buckets":["hr-exports","hr-archive"]}]}'

Cheatsheet extras: fine-grained access to secrets, safe rotation cutover and old patterns

The cheat sheet adds three practical points: how to let a role read only some secrets or parameters (condition keys and the KMS encryption context), why turning on rotation can break applications at once, and an older “secrets in an encrypted S3 bucket” pattern you may still see in practice questions.

Safe cutover when you start rotating

Order matters: (1) store the current password as a secret, (2) change every application to read it at run time (SDK, caching library or the Lambda extension), (3) only then turn on rotation. If you enable rotation and don’t want an immediate rotation, use --no-rotate-immediately; the first rotation then waits for the schedule.

{
  "Effect": "Allow",
  "Action": [ "ssm:GetParameter", "ssm:GetParametersByPath" ],
  "Resource": "arn:aws:ssm:eu-west-1:111122223333:parameter/prod/app1/*"
},
{
  "Effect": "Allow",
  "Action": "kms:Decrypt",
  "Resource": "arn:aws:kms:eu-west-1:111122223333:key/1234abcd-...",
  "Condition": { "StringLike": {
    "kms:EncryptionContext:PARAMETER_ARN":
      "arn:aws:ssm:eu-west-1:111122223333:parameter/prod/app1/*" } }
}

Lecture summary map

Day 5 on one screen.

1. Mind map

2. Match the requirement to the control

3. “If the question says… pick…”

Must-remember cheat sheet

Core quiz

Check the basics first. Pick an answer, then press Check.

Hard quiz

Harder than most real exam questions on purpose, with one “choose two” and one matching question. Aim for 9 out of 12.

Domain 5 review quiz (Days 1–5)

Questions from every Data Protection day. If you miss one, reopen that day’s lecture and its “Must remember” boxes.

Practice test questions (from your mock exams)

These 8 questions match today’s topics. 7 come from your own mock exams (the “practice tests” folder); the wording was tidied, and where a mock answer was out of date or wrong, the explanation says so, with the mock and question number at the end. The last one is a new exam-style question (marked “New question”) written in October 2026 from the SCS-C03 exam guide and current AWS documentation, to cover recent changes.

Hands-on lab (30 minutes, low cost)

1. Create a secret with a customer managed key, read it with get-secret-value, then look at list-secret-version-ids to see the staging labels.
2. Call rotate-secret with a simple rotation Lambda (or just put a new value with put-secret-value) and watch AWSCURRENT and AWSPREVIOUS move.
3. Create a SecureString parameter under /lab/dev/ and read it with and without --with-decryption.
4. Create a log group, add a data protection policy for EmailAddress, write a log event containing an email with put-log-events, and view it masked. Then view it with a role that has logs:Unmask.
5. Optional: enable Macie’s 30-day trial, run a one-time job on a bucket with a fake test file containing sample card numbers, then disable Macie.
6. Clean up: delete the secret with --force-delete-without-recovery (lab only), the parameter, the log group and the KMS key schedule.