Manage Sensitive Data In Application Code | 🏗️ Build A Secure Configuration Service

Short summary

AWS Developer Associate exam guide on managing sensitive data in applications. Contrasts Secrets Manager (auto-rotation, KMS encryption, $0.40/secret/month) with Parameter Store (free, simpler configs). Provides data classification frameworks for PII/PHI/financial data with compliance requirements, plus practical patterns for masking, tokenization, and multi-tenant isolation using DynamoDB partition keys and IAM conditions.

• •Secrets Manager: automatic rotation for database credentials, KMS encryption, cross-account access. Parameter Store: free tier, cheaper, best for static config and feature flags.
• •Data classification: PII, PHI, and financial data require encryption, masking in logs/API responses, compliance auditing; public data needs no special handling.
• •Multi-tenant isolation: partition key prefixes with IAM dynamodb:LeadingKeys conditions (most common), Cognito JWT scoping, or separate AWS accounts (strongest isolation).

Generated with AI, which can make mistakes.