SAP-C02 Question 415
Single answerAn e-commerce company wants to securely store and manage database credentials for their production environment. They want to ensure that the credentials are automatically rotated every 30 days without impacting the application. The solution should also allow developers to retrieve credentials programmatically without embedding sensitive information in the code. Which AWS service and configuration should they use to meet these requirements?
- A
Use AWS Secrets Manager to store the database credentials and enable automatic rotation with a Lambda function.
- B
Use Amazon RDS to store the database credentials and enable IAM database authentication.
- C
Use AWS Systems Manager Parameter Store with SecureString to store the database credentials and enable automatic rotation.
- D
Use Amazon DynamoDB to store the database credentials and implement an application-layer function for rotation.
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is the best choice for securely storing and managing sensitive information like database credentials. It natively supports automatic rotation of secrets using AWS Lambda, which aligns with the requirement of rotating credentials every 30 days. It also allows developers to retrieve secrets programmatically, reducing the risk of embedding sensitive information in application code.
- A. Correct.
Correct. AWS Secrets Manager is designed for storing and managing sensitive information like database credentials. It provides built-in support for automatic rotation using Lambda functions, which meets the requirement for rotating credentials every 30 days without impacting the application.
- B. Incorrect.
Incorrect. While IAM database authentication is a secure way to access Amazon RDS databases, it does not support automatic rotation of database credentials, nor is it designed to store and manage sensitive information like Secrets Manager.
- C. Incorrect.
Incorrect. AWS Systems Manager Parameter Store does allow you to store secure strings, but it does not natively support automatic rotation of secrets like Secrets Manager does.
- D. Incorrect.
Incorrect. Amazon DynamoDB is not a secrets management service and does not provide built-in mechanisms for securely storing credentials or implementing automatic rotation.