Exam Guide: Developer - Associate
🏗️ Domain 2: Security
📘 Task 3: Manage Sensitive Data In Application Code
Managing Sensitive Data In Application Code is about keeping secrets out of your code, classifying data properly, and building applications that handle sensitive data safely.
You need to know when to use Secrets Manager vs Parameter Store, how to mask PII in API responses and logs, and how to isolate data in multi-tenant applications.
The ability to choose the right secret management service, implement data sanitization, and enforce tenant-level data boundaries, is vital.
📘Concepts
Data Classification
Understand data sensitivity levels and how each should be handled:
| Classification | Examples | Handling Requirements |
|---|---|---|
PII (Personally Identifiable Information) | Name, email, SSN, phone number, address | Encrypt at rest and in transit, mask in logs and API responses, restrict access |
PHI (Protected Health Information) | Medical records, insurance IDs, lab results | HIPAA compliance, encryption required, audit trail mandatory |
| Financial | Credit card numbers, bank accounts, transaction data | PCI DSS compliance, tokenization, never store full card numbers |
| Public | Marketing content, public API docs | No special handling needed |
💡If a scenario mentions compliance or audit trail, think encryption with KMS (for CloudTrail logging) and Secrets Manager (for automatic rotation). If it mentions PII in logs, think data masking and sanitization.
Secrets Manager vs SSM Parameter Store
Both store configuration and secrets.
| Feature | Secrets Manager | SSM Parameter Store |
|---|---|---|
| Automatic rotation | Yes (built-in for RDS, Redshift, DocumentDB) | No (you build it yourself with Lambda) |
| Cost | $0.40/secret/month + $0.05 per 10,000 API calls | Free (Standard tier), $0.05/advanced parameter/month |
| Cross-account access | Yes (via resource policy) | Yes (advanced parameters only) |
| Max size | 64 KB | 4 KB (Standard) / 8 KB (Advanced) |
| Versioning | Automatic (AWSCURRENT, AWSPREVIOUS labels) | Yes (version history) |
| Encryption | Always encrypted (KMS required) | Optional (SecureString type uses KMS) |
| CloudFormation resolve | {{resolve:secretsmanager:...}} | {{resolve:ssm:...}} |
| Best for | Database credentials, API keys that need rotation | App config, feature flags, non-rotating secrets |
💡If it says automatic rotation or database credentials, the answer is Secrets Manager.
If it says application configuration, feature flags, or free, the answer is Parameter Store.
If it says encrypted configuration, Parameter Store with SecureString works and costs nothing.
Data Masking and Sanitization Patterns
| Pattern | What It Does | When to Use |
|---|---|---|
| Field Masking | Replace characters with asterisks (j***[email protected]) | API responses containing PII |
| Log Sanitization | Strip or redact sensitive fields before logging | Any log output that might contain secrets |
| Tokenization | Replace sensitive data with a non-reversible token | Credit card numbers, SSNs in databases |
| Field-Level Encryption | Encrypt individual fields within a record | When only some fields in a record are sensitive |
Multi-Tenant Data Isolation Patterns
| Pattern | How It Works | Isolation Level |
|---|---|---|
| Partition Key Prefix | Prefix DynamoDB keys with tenant ID (TENANT#123#ORDER#456) | Logical (application-enforced) |
| IAM Condition Keys | Use dynamodb:LeadingKeys condition to restrict access | Policy-enforced |
| Cognito Claims | Extract tenant ID from JWT and scope all queries | Token-Enforced |
| Separate Tables/Accounts | Each tenant gets their own table or AWS account | Physical (strongest isolation) |
💡 Partition key isolation with IAM condition keys is the most common pattern. Separate accounts is the strongest but most expensive.
dynamodb:LeadingKeysrestricts which partition keys a principal can access.
When to Use Each Secret Management Approach
| Scenario | Service | Why |
|---|---|---|
| RDS database password that rotates every 30 days | Secrets Manager | Built-in rotation for RDS |
| API endpoint URL that differs per environment | Parameter Store (String) | Simple config, no encryption needed, free |
| Third-party API key that doesn't rotate | Parameter Store (SecureString) | Encrypted, free, no rotation needed |
| OAuth client secret shared across accounts | Secrets Manager | Cross-account resource policies |
| Feature flag (enable/disable a feature) | Parameter Store (String) or AppConfig | Simple config value |
| Lambda environment variable with a password | KMS encryption + runtime decryption | Encrypted at rest, decrypted at cold start |
🏗️ Build A Secure Configuration Service
Build a Secure Configuration Service that demonstrates secret and configuration management:
- Database credentials stored in Secrets Manager with console-based setup
- Application configuration stored in SSM Parameter Store
- A Lambda function that retrieves secrets and config at runtime
- Data masking applied to API responses containing PII
- A multi-tenant data isolation pattern using DynamoDB with partition key prefixes and IAM conditions
Prerequisites
🏗️
SOCIAL SHARE CARD GENERATOR