Lesson 03 — Secrets Management, Certificates & Sensitive Data Discovery

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 06 – Data Protection & Encryption

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand why secrets should never be stored in application code.
Secure credentials using AWS Secrets Manager.
Understand when to use Systems Manager Parameter Store.
Protect web applications using AWS Certificate Manager (ACM).
Discover sensitive data using Amazon Macie.
Build an enterprise secret management strategy.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Intermediate

Prerequisites: Lesson 02 – AWS Encryption Services

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies is launching a new Learning Management System.

The application connects to:

Amazon RDS
Amazon S3
External AI APIs
Payment Gateway
Email Service

Developers currently store the following information inside application configuration files:

Database Password

AWS Access Keys

API Keys

SMTP Password

JWT Secret

The Cloud Security team immediately rejects the deployment.

Their response is simple:

“Secrets never belong inside application code.”

At the same time, CloudNova must:

Secure all HTTPS traffic.
Protect customer information stored in Amazon S3.
Detect accidental exposure of sensitive student data.

Three Layers of Data Protection

Enterprise security protects three different things.

Credentials

↓

Communication

↓

Stored Data

AWS provides different services for each.

Requirement	AWS Service
Secrets	AWS Secrets Manager
SSL/TLS Certificates	AWS Certificate Manager
Sensitive Data Discovery	Amazon Macie

What is a Secret?

A secret is any information that provides access to systems or data.

Examples include:

Database passwords
API keys
OAuth tokens
JWT signing keys
SSH private keys
Third-party service credentials

If a secret is exposed, attackers may gain unauthorised access.

What is AWS Secrets Manager?

AWS Secrets Manager securely stores and manages sensitive credentials.

Instead of this:

Application

↓

config.json

↓

Password

Use:

Application

↓

IAM Role

↓

AWS Secrets Manager

↓

Database Password

The application retrieves the secret only when it needs it.

Benefits of Secrets Manager

CloudNova uses Secrets Manager because it provides:

Encrypted storage
IAM integration
Automatic rotation
Version history
CloudTrail auditing
Secure API access

Secrets Manager vs Parameter Store

Students often confuse these services.

Secrets Manager	Parameter Store
Passwords	Configuration Values
API Keys	Environment Variables
Automatic Rotation	Manual Updates
Built-in Secret Lifecycle	General Configuration Storage
Premium Service	Standard & Advanced Tiers

Rule of Thumb

Secrets → Secrets Manager
Configuration → Parameter Store

Automatic Secret Rotation

Instead of changing passwords manually:

Application

↓

Secrets Manager

↓

Lambda Rotation

↓

Database

↓

Updated Secret

Applications continue to retrieve the latest version automatically.

What is AWS Certificate Manager (ACM)?

Applications should never send sensitive information over unencrypted connections.

AWS Certificate Manager issues and manages SSL/TLS certificates.

Example:

User

↓

HTTPS

↓

Application Load Balancer

↓

EC2

Traffic is encrypted before reaching the application.

Benefits of ACM

CloudNova uses ACM because it provides:

Free public certificates
Automatic renewal
Easy integration with ALB
CloudFront integration
API Gateway integration

Developers do not need to manually install certificates.

ACM Architecture

Internet

↓

HTTPS

↓

Application Load Balancer

↓

AWS Certificate Manager

↓

EC2 Application

All communication between users and the application is encrypted using TLS.

What is Amazon Macie?

Encryption protects data.

Macie discovers sensitive data.

Macie continuously scans Amazon S3 for:

Personally Identifiable Information (PII)
Financial information
Credentials
Personal records

It helps organisations identify data that should be protected.

Amazon Macie Architecture

Amazon S3

↓

Amazon Macie

↓

Sensitive Data Discovery

↓

Security Findings

↓

Security Team

Macie does not encrypt data—it identifies where sensitive information exists.

Examples of Sensitive Data

Macie can identify information such as:

Credit Card Numbers
Passport Numbers
PAN Numbers
Aadhaar Numbers
Email Addresses
Phone Numbers
Medical Information

This helps organisations meet regulatory and privacy obligations.

Enterprise Data Protection Workflow

CloudNova protects data using multiple AWS services.

Application

↓

IAM Role

↓

Secrets Manager

↓

Amazon RDS

↓

AWS KMS

↓

Amazon S3

↓

Amazon Macie

↓

CloudTrail

↓

CloudWatch

Each service has a specific role in the overall security architecture.

Enterprise Best Practices

CloudNova standards include:

Never hardcode credentials.
Store secrets in AWS Secrets Manager.
Store configuration values in Parameter Store.
Use ACM for all internet-facing applications.
Enable HTTPS everywhere.
Scan S3 buckets with Amazon Macie.
Review Macie findings regularly.
Rotate secrets automatically whenever possible.
Audit all secret access with CloudTrail.

🛠 Lab 01 — Store a Database Password

Navigate to:

AWS Console

↓

Secrets Manager

↓

Store New Secret

Create:

CloudNova-RDS-Password

Verify:

Secret created
KMS encryption enabled

🛠 Lab 02 — Retrieve a Secret

Using an IAM Role with appropriate permissions:

Retrieve the secret from the AWS Console.

Review:

Secret Value
Version
Rotation Settings

🛠 Lab 03 — Store Configuration in Parameter Store

Navigate to:

Systems Manager

↓

Parameter Store

Create:

/Application/Environment

Production

Compare Parameter Store with Secrets Manager.

🛠 Lab 04 — Request an SSL Certificate

Navigate to:

AWS Certificate Manager

↓

Request Certificate

Create a public certificate for:

app.cloudnova.com

Review:

Domain Validation
Certificate Status
Automatic Renewal

🛠 Lab 05 — Enable Amazon Macie

Navigate to:

Amazon Macie

↓

Enable Service

Review:

Dashboard
S3 Buckets
Discovery Jobs
Findings

🛠 Lab 06 — Run a Sensitive Data Discovery Job

Create a discovery job.

Select:

CloudNova Student Documents Bucket

Review:

Sensitive Data Findings
Risk Level
Classification Results

💻 AWS CLI Lab

List Secrets

aws secretsmanager list-secrets

Retrieve a Secret

aws secretsmanager get-secret-value \
    --secret-id CloudNova-RDS-Password

List Parameters

aws ssm describe-parameters

Get Parameter

aws ssm get-parameter \
    --name /Application/Environment

List ACM Certificates

aws acm list-certificates

List Macie Findings

aws macie2 list-findings

✅ Verification

Verify:

✔ Secret stored securely.

✔ Parameter created.

✔ ACM certificate requested.

✔ HTTPS architecture understood.

✔ Amazon Macie enabled.

✔ Sensitive data findings reviewed.

✔ CloudTrail logs secret access.

🔍 Troubleshooting

Problem

Application cannot retrieve the secret.

Check:

IAM Role permissions.
Secret name.
AWS Region.
KMS permissions.

Problem

Certificate remains in Pending Validation.

Verify:

DNS records.
Domain ownership.
Validation method.

Problem

Macie reports no findings.

Review:

Discovery job completed.
S3 bucket selected.
Test data available.

🚫 Common Mistakes

❌ Storing passwords in source code.

❌ Sharing secrets through email or chat.

❌ Using self-signed certificates in production.

❌ Forgetting certificate renewal.

❌ Assuming encryption alone classifies sensitive data.

❌ Ignoring Macie findings.

🧪 DIY Challenge

CloudNova is launching a customer portal.

Design the security solution.

Requirements:

Store database credentials.
Store API keys.
Configure HTTPS.
Scan uploaded student documents.
Monitor secret access.

Create an architecture diagram showing:

Secrets Manager
ACM
Application Load Balancer
EC2
Amazon RDS
Amazon S3
Amazon Macie
AWS KMS

Explain how each service contributes to protecting the application.

📊 Knowledge Check

What is a secret?
Why should secrets never be stored in application code?
What is the difference between Secrets Manager and Parameter Store?
What is AWS Certificate Manager used for?
Why is HTTPS important?
What is Amazon Macie?
Which AWS service automatically rotates database credentials?
Which AWS service identifies sensitive data in Amazon S3?
How does IAM improve secret management?
Why should organisations continuously review Macie findings?

💡 Key Takeaways

After completing this lesson, you should understand:

AWS Secrets Manager securely stores and rotates sensitive credentials, eliminating the need to hardcode secrets in applications.
Systems Manager Parameter Store is best suited for configuration values, while Secrets Manager is designed for passwords, API keys and other sensitive information.
AWS Certificate Manager simplifies the deployment and lifecycle management of SSL/TLS certificates, enabling secure HTTPS communications.
Amazon Macie continuously discovers and classifies sensitive data stored in Amazon S3, helping organisations strengthen data protection and meet compliance requirements.
Together, Secrets Manager, ACM and Macie provide a comprehensive approach to protecting credentials, securing communications and identifying sensitive data in enterprise AWS environments.

🚀 Next Lesson

➡️ Lesson 04 — Enterprise Data Protection Architecture