Q. How do you handle sensitive parameters like passwords?

 Store them as “SecureString” in Parameter Store with KMS encryption, and ensure the Beanstalk EC2 role has IAM permission to decrypt.