A team stores (a) non-secret config values and (b) database credentials requiring automatic rotation. Which split is correct?
A.Both in Secrets Manager
Works, but wastes Secrets Manager pricing on non-secret config.
B.Config in SSM Parameter Store (free tier); credentials in Secrets Manager for built-in rotation
Correct. Right tool for each — Parameter Store for config, Secrets Manager for rotating secrets.
C.Both in Parameter Store
Parameter Store can't natively rotate RDS credentials.
D.Both in environment variables
Env vars expose plaintext and never rotate.
Why this answer
Parameter Store is the cheap hierarchical store for config/plain values (with a SecureString tier); Secrets Manager adds automatic rotation, cross-service integration (RDS/Redshift/DocumentDB), and random secret generation — at a per-secret cost.
Correct answer: B · Last reviewed 2026-10-27
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security