An application is implemented in the AWS platform. Its automation test suites include test cases for different environments such as system test, staging and production. The test scripts contain usernames and passwords to sign in to the application. As the test scripts are saved in Github, it has some security issues. You plan to store the credentials in the Systems Manager Parameter Store instead. Which benefits can this approach bring? (Select TWO.)

Answer options:

A.The stored passwords can be automatically rotated every year, and the test cases do not need to be changed when using the passwords.
B.You can use IAM policies to restrict access to the API operations for the parameters such as GetParameter.
C.Parameter Store integrates with CloudTrail so that operations for the parameters are recorded.
D.To make sure that the parameter values in Parameter Store are always returned correctly, there is no versioning for the parameters, and the values are overwritten when updated.
E.Parameter values stored in Parameter Store can be automatically rotated every year so that you do not need to rotate the credentials manually.

Correct Answer – B, C
Parameter Store allows you to separate the secrets and configuration data from the test scripts. Check the Parameter Store features in https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html.
Option A is incorrect: Because the stored passwords do not rotate automatically. This is a feature of Secrets Manager instead of Parameter Store.
Option B is CORRECT: Check https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html for how to control the access by IAM.
Option C is CORRECT: Because AWS CloudTrail can be used to monitor and audit how parameters in Parameter Store are used.
Option D is incorrect: Because Parameter Store does support versioning. You can specify a parameter name and a specific version number in API calls and SSM documents.
Option E is incorrect: Because Parameter Store does not automatically rotate the parameter values. This is unlike the AWS Secrets Manager service.