Configure and manage instances at scale with AWS Systems Manager State Manager, Run Command, Patch Manager and Parameter Store.

A payments service running on Amazon EC2 reads configuration from AWS Systems Manager Parameter Store under the hierarchy /payments/prod/, which holds plaintext settings and one database password. Security requires that the password is encrypted at rest with a customer managed key, that the database value never appears in plaintext in the parameter listing, and that the instance role can read only the parameters beneath /payments/prod/ and nothing else. Which TWO actions together meet these requirements? (Select TWO.)

• AStore the database password as a SecureString parameter encrypted with a customer managed AWS KMS key, and grant the instance role kms:Decrypt on that specific key so the value is returned only when explicitly decrypted.check_circle Correct
• BStore the database password as a standard String parameter and rely on the Amazon EC2 instance metadata service plus the instance role to keep the value private to the running instance only.
• CAttach an IAM policy to the instance role that allows ssm:GetParameter and ssm:GetParametersByPath only on the resource ARN matching arn:aws:ssm:region:account:parameter/payments/prod/*.check_circle Correct
• DGrant the instance role ssm:GetParameter on the resource arn:aws:ssm:region:account:parameter/* and use a parameter naming convention so engineers know which values are production.

Why A is correct: A SecureString parameter encrypts the value at rest with the chosen KMS key and is returned ciphered unless decryption is requested, and scoping kms:Decrypt to that key keeps the password protected while still readable by the service.

Why B is wrong: A standard String parameter stores the value in plaintext and the metadata service has nothing to do with Parameter Store, so the password would be exposed in the parameter listing, violating the encryption requirement.

Why C is correct: Scoping the parameter actions to the ARN pattern for the /payments/prod/ path grants least-privilege read access to exactly that hierarchy and denies the other branches by omission, meeting the scoping requirement.

Why D is wrong: A wildcard on the whole parameter namespace is tempting for simplicity, but it lets the role read every parameter in the account, breaking least privilege, and a naming convention is not an access control.