DVA-C02 Question 207
Single answerA developer is building a serverless application on AWS that requires database credentials to connect to an Amazon RDS instance. The credentials should not be hardcoded in the application code, and they must be rotated automatically to enhance security. Which solution will best meet these requirements?
- A
Store the credentials in AWS Secrets Manager and configure automatic rotation.
- B
Store the credentials in AWS Systems Manager Parameter Store with SecureString and enable automatic rotation.
- C
Encrypt the credentials using AWS Key Management Service (KMS) and store them as environment variables in AWS Lambda.
- D
Hardcode the credentials in the application code but encrypt them using AWS Key Management Service (KMS).
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is the ideal service for securely managing database credentials, as it offers native support for secrets management, automatic rotation, and seamless integration with AWS services. In contrast, other options either lack automatic rotation or involve poor security practices, making them unsuitable for this scenario.
- A. Correct.
This is the correct option because AWS Secrets Manager is specifically designed for managing secrets like database credentials, supports automatic rotation, and integrates well with AWS services.
- B. Incorrect.
While AWS Systems Manager Parameter Store can store secrets using the SecureString type, it does not natively support automatic rotation of secrets, making it less suitable for this scenario.
- C. Incorrect.
Although encrypting credentials with AWS KMS and storing them in environment variables provides some level of security, it does not offer automatic rotation, which is a key requirement of the scenario.
- D. Incorrect.
Hardcoding credentials, even if encrypted with AWS KMS, is a poor practice and fails to meet the requirements of security and automatic rotation.