SAP-C02 Question 416
Single answerAn organization is developing a serverless application on AWS that requires database credentials to connect to an RDS instance. The development team wants to ensure these credentials are securely stored and rotated automatically without requiring manual intervention. Which AWS service or combination of services should the team use to achieve this?
- A
AWS Secrets Manager
- B
AWS Systems Manager Parameter Store with a SecureString parameter
- C
AWS KMS (Key Management Service)
- D
Amazon Cognito
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is the ideal choice for this scenario because it is specifically designed to securely store secrets like database credentials and provides native support for automatic rotation of those secrets. This ensures both security and operational efficiency without requiring manual intervention. While other services like Systems Manager Parameter Store allow for storing secrets, they lack the automatic rotation capability that is crucial in this scenario.
- A. Correct.
AWS Secrets Manager is the correct choice for securely storing, managing, and automatically rotating secrets such as database credentials. It is specifically designed for this purpose and supports integration with RDS for automatic rotation of credentials.
- B. Incorrect.
AWS Systems Manager Parameter Store provides a way to store configuration data and secrets with SecureString, but it does not support automatic rotation of secrets like Secrets Manager does. While it can securely store secrets, it is not ideal for this use case.
- C. Incorrect.
AWS KMS is used for managing encryption keys, not for storing secrets or automatically rotating them. It can be used in conjunction with other services, but it is not the correct standalone solution for this scenario.
- D. Incorrect.
Amazon Cognito is primarily used for managing user authentication and authorization, not for securely storing or rotating database credentials. It is not relevant to this use case.