Secrets, Masking, and Resilience

Credentials that rotate themselves, sensitive data masked in logs and messages before an operator can read it, backups that survive a compromised administrator, and lifecycle rules that retain data exactly as long as the obligation lasts — no longer.

Content current as of 2026-10.

Lessons

1. Secrets Manager and rotation
2. Masking sensitive data
3. Backup, Vault Lock, and ransomware
4. Lifecycle and retention

Sources

• SCS-C03 exam guide — Content Domain 5 (tasks 5.2–5.3)
• AWS Secrets Manager — rotating secrets
• CloudWatch Logs — help protect sensitive log data with masking
• Amazon SNS — message data protection
• AWS Backup — Vault Lock