SOA-C02 Question 217
Single answerA company needs to securely store database credentials and rotate them automatically. They want to ensure that the credentials are encrypted both at rest and in transit, and that access can be tightly controlled and audited. Which AWS service should the SysOps Administrator use to meet these requirements?
- A
AWS Secrets Manager
- B
Systems Manager Parameter Store
- C
Amazon RDS
- D
AWS Key Management Service (KMS)
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is specifically designed to securely manage secrets such as database credentials. It provides features such as automatic rotation, encrypted storage, and integration with AWS Identity and Access Management (IAM) for fine-grained access control. These capabilities make it the best solution for the given scenario, whereas other services like Systems Manager Parameter Store or AWS KMS either lack automatic rotation or are designed for a different purpose.
- A. Correct.
AWS Secrets Manager is the correct choice as it is specifically designed for securely storing secrets, such as database credentials, and it supports automatic rotation, encryption at rest, and access auditing.
- B. Incorrect.
Systems Manager Parameter Store can also store secrets, but it does not natively provide automatic rotation of credentials, making it less suitable for this requirement.
- C. Incorrect.
Amazon RDS is a managed database service and is not designed for storing secrets. It can be used to manage databases but does not handle the secure storage of credentials.
- D. Incorrect.
AWS Key Management Service (KMS) is used for managing encryption keys and not for storing secrets like database credentials. While it can be used to encrypt secrets, it is not a complete solution for this scenario.