SCS-C02 Question 400
Select 2Your company uses AWS Secrets Manager to store database credentials. A security audit has revealed that many secrets are not rotated, which increases the risk of credential compromise. You are tasked with implementing automated rotation of secrets for an Amazon RDS database. Which of the following steps should you take to configure automated secret rotation properly?
- A
Enable rotation for the secret in the AWS Secrets Manager console and specify the rotation interval.
- B
Ensure the secret is associated with an Amazon RDS database by configuring the secret's resource policy.
- C
Create a Lambda function with the required IAM permissions to perform the rotation and attach it to the secret.
- D
Attach a custom KMS key to the secret to enable secure rotation of credentials.
- E
Update the secret's metadata to include the username and password required for rotation.
Show answer and explanation
Correct answers: A, C
Explanation
To enable automated rotation of secrets in AWS Secrets Manager, you must first enable rotation on the secret and specify an interval. Additionally, you need to create a Lambda function that implements the rotation logic, such as retrieving new credentials and updating the secret. A resource policy or custom KMS key is not required for this process. These steps ensure that secrets are rotated automatically, reducing the risk of credential compromise.
- A. Correct.
Correct. Enabling rotation and specifying the interval is a required step for configuring automated rotation in Secrets Manager.
- B. Incorrect.
Incorrect. Secrets in Secrets Manager do not require a resource policy to be associated with an Amazon RDS database. Instead, they are linked to the target resource through the secret's metadata.
- C. Correct.
Correct. A Lambda function with the appropriate permissions is required to perform the rotation logic for a secret.
- D. Incorrect.
Incorrect. Attaching a custom KMS key is not required for rotation. Secrets Manager automatically encrypts secrets with a default or custom KMS key, but this is unrelated to rotation.
- E. Incorrect.
Incorrect. The secret's metadata already includes the necessary username and password when the secret is created. Updating metadata is not required for rotation.