SOA-C02 Question 218
Single answerAn organization needs to securely store database credentials and ensure that these credentials can be automatically rotated without manual intervention. The solution should also allow specific IAM roles to retrieve the credentials. Which AWS service should be used to meet these requirements?
- A
AWS Systems Manager Parameter Store
- B
AWS Secrets Manager
- C
Amazon RDS
- D
AWS Key Management Service (KMS)
Show answer and explanation
Correct answer: B
Explanation
AWS Secrets Manager is the ideal service for securely storing secrets like database credentials and provides native support for automatic rotation. It also integrates with IAM policies for fine-grained access control, making it the best choice for this scenario.
- A. Incorrect.
AWS Systems Manager Parameter Store can store secrets, but it does not natively support automatic rotation of database credentials. It is better suited for storing less dynamic secrets or configurations.
- B. Correct.
AWS Secrets Manager is specifically designed to securely store, manage, and automatically rotate secrets such as database credentials. It also integrates with IAM to control access to secrets.
- C. Incorrect.
Amazon RDS is a managed database service, but it does not store secrets or manage their rotation. It can, however, integrate with AWS Secrets Manager for this purpose.
- D. Incorrect.
AWS Key Management Service (KMS) is used for managing encryption keys, not for storing and rotating secrets like database credentials.