How to securely store and pass API keys to a containerized application on AWS?
A developer is building a containerized application on AWS. The application communicates with a third-party service by using API keys. The developer needs a secure way to store the API keys and pass the API keys to the containerized application. Which solutions will meet these requirements? (Choose two.)
Community Votes
100% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests your understanding of AWS native secret management services and common insecure alternatives. The trap is overlooking that CloudFormation parameters or base64-encoded values are not secure for secrets, while both Parameter Store and Secrets Manager are designed exactly for this purpose.
In AWS DVA-C02, securely storing and passing API keys to a containerized application is best achieved using AWS Systems Manager Parameter Store (SecureString) or AWS Secrets Manager. The community consensus confirms that both services provide secure, manageable secrets retrieval for applications.
The most common wrong answer is Option C (CloudFormation parameter) because it passes API keys via environment variables, but this exposes secrets in the template and parameter values, making them visible in plaintext. Another common trap is Option B, which assumes base64 encoding provides security, but base64 is not encryption.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Options A and E are correct because both AWS Systems Manager Parameter Store (with SecureString) and AWS Secrets Manager are fully managed services that securely store API keys. They provide encryption, IAM-based access control, and allow the containerized application to retrieve secrets at runtime via API calls. The official AWS best practices documentation explicitly recommends using either of these services for storing secret materials in containerized environments.
Why the Other Options Are Wrong
Option B is wrong because base64 encoding is easily reversible and does not provide security; storing secrets in CloudFormation templates in that form is insecure. Option C is wrong because CloudFormation parameters are visible in the template and are not designed for secret handling; they may appear in logs or console views. Option D is wrong because embedding API keys directly in the application or container image makes them accessible to anyone with access to the image and prevents easy rotation.
Community Comment Notes
The comments overwhelmingly support answers A and E, with one commenter noting they have used Secrets Manager to store API keys in practice. Another commenter shared an official AWS documentation link that explicitly mentions using AWS Secrets Manager or SSM Parameter Store for secret materials. A separate comment correctly points out that option C is not viable, reinforcing the consensus that environment variables from CloudFormation parameters are an insecure choice.
Official Reference
Exam Strategy
On exam day, when selecting multiple answers for secret storage, immediately eliminate any option that reveals secrets in plaintext, such as CloudFormation parameters, base64 encoding, or embedding secrets in images. Remember that both Parameter Store SecureString and Secrets Manager are valid secure options, and they are often paired together in correct multi-select answers.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →