SCS-C02 Question 403
Single answerYour company is using an Amazon RDS database to store sensitive customer information. To enhance security, you need to rotate the database credentials automatically without impacting application availability. Which approach should you take using AWS Secrets Manager?
- A
Manually update the database credentials in AWS Secrets Manager and notify the application team to update the credentials in the application.
- B
Enable automatic rotation for the database secret in Secrets Manager and attach an AWS Lambda function to handle the rotation logic.
- C
Create a new secret in AWS Secrets Manager for the new credentials and update the application code to use the new secret.
- D
Use AWS Key Management Service (KMS) to directly rotate the database credentials and manage them in Secrets Manager.
Show answer and explanation
Correct answer: B
Explanation
AWS Secrets Manager provides a built-in capability to automatically rotate secrets for supported databases like Amazon RDS. This is achieved by enabling automatic rotation and using an AWS Lambda function to manage the process. This ensures minimal disruption to applications and eliminates the need for manual updates, making it the most efficient and secure solution.
- A. Incorrect.
Manually updating credentials in Secrets Manager and notifying the application team would require manual intervention and could lead to potential downtime or errors, which does not meet the requirement for automatic rotation.
- B. Correct.
Enabling automatic rotation in Secrets Manager and attaching a Lambda function to handle the rotation logic is the correct approach. Secrets Manager can automatically rotate RDS database credentials without requiring manual updates, ensuring seamless integration with applications.
- C. Incorrect.
Creating a new secret and updating the application code introduces additional manual steps and is not an efficient solution for automatic rotation.
- D. Incorrect.
AWS KMS is used for encryption key management, not for directly rotating database credentials. Secrets Manager is the appropriate service for this use case.