3.2 Security Improvement
Official task mapping
SAP-C02 task 3.2: Retention, secrets and patching knowledge; least-privilege review and remediation prioritization. This lesson applies the official task to an original design exercise; it is not an exhaustive exam syllabus.
Prerequisites
Review Inspector, Config and Secrets Manager. Be able to explain the relevant failure boundary and access/cost model before choosing a service.
Improve layered controls
Use CloudTrail for recorded API activity and Config for supported configuration history/compliance evaluation. A Config aggregator centralizes views; it does not automatically configure every recorder or fix every account. Remediation needs permissions, exception handling and a safe target scope.
Secrets Manager supports managed/custom rotation workflows; Parameter Store supports configuration and encrypted parameters with tier-specific sharing/cost rules. Choose according to rotation, access and lifecycle requirements, not a universal free-versus-paid slogan. Rotation must update the backend and verify the pending credential before promoting it.
Current Inspector covers supported EC2, ECR and Lambda scanning capabilities with scan-type-specific prerequisites. EC2 agent-based and agentless options differ. Inspector Classic retired on May 20, 2026; classic assessment templates/targets are not the current service workflow. A finding is evidence for triage, not proof a patch can safely be applied immediately.
Secrets, compliance and patching reference
| Requirement | Secrets Manager | Parameter Store |
|---|---|---|
| Sensitive application credentials | Purpose-built secret lifecycle | Supported encrypted parameters |
| Rotation | Supported managed/custom workflows | Application/custom integration where required |
| Cross-account access | Policy/key and feature prerequisites | Supported advanced-parameter sharing |
| Pricing | Regional secret/API/rotation dependencies | Tier/API/integration dependent |
| Application configuration | Possible | Common use case |
Do not assume “Standard is free” covers every API or integration, or that every credential can rotate without backend support. The application needs retry/cache behavior during credential changes.
Config managed/custom rules evaluate supported configuration; CloudTrail identifies recorded actor/action context. An aggregator view is not full collection by itself. Automated remediation can race with a later resource change, so recheck state and exclusions before action.
Define patch baseline, approved/rejected updates, deployment rings, maintenance window, application health checks and rollback. Prioritize Inspector findings by exposure and exploitability, not only score. Backups must be restorable and retained under policy; patching and security isolation cannot silently invalidate recovery.
Scenario and rationale
A security review finds an exposed instance with a critical vulnerability and an application secret unchanged for two years. Prioritize exposure reduction and a tested patch/rotation path. Assess exploitability, business criticality, compensating controls and rollback, while tracking exceptions centrally.
Reject treating all findings as equal or patching production without a maintenance/recovery plan. Reject changing only the stored secret string: the application/backend credentials can diverge and cause an outage.
Practice drill
Build a ranked remediation backlog from five supplied findings. For the top item, specify owner, evidence, patch baseline/window, pre-change backup, success checks and rollback. For the secret, describe create/set/test/finish stages and retry idempotency without displaying secret values. Explain which actions need separate approval.
References
- Official Domain 3 task guide
- Current Inspector scanning types
- Secrets rotation stages
- Systems Manager Patch Manager
- Classic retirement
Return to Domain 3. The drill is proposed study work, not a claim of a completed deployment.