How to configure RDS for MySQL access without long-term credentials?

A company has an ecommerce web application that uses an on-premises MySQL database as a data store. The company migrates the on-premises MySQL database to Amazon RDS for MySQL. A developer needs to configure the application's access to the RDS for MySQL database. The developer's solution must not use long term credentials. Which solution will meet these requirements?

  1. Enable IAM database authentication on the RDS for MySQL DB instance. Create an IAM role that has the minimum required permissions. Assign the role to the application. Source Reference Answer
  2. Store the MySQL credentials as secrets in AWS Secrets Manager. Create an IAM role that has the minimum required permissions to retrieve the secrets. Assign the role to the application.
  3. Configure the MySQL credentials as environment variables that are available at runtime for the application.
  4. Store the MySQL credentials as SecureString parameters in AWS Systems Manager Parameter Store. Create an IAM role that has the minimum required permissions to retrieve the parameters. Assign the role to the application.

Community Votes

A
64%
B
36%

64% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question specifically requires avoiding long-term credentials, which points directly to IAM database authentication using short-lived 15-minute authentication tokens instead of static passwords.

This question tests the use of IAM database authentication for Amazon RDS for MySQL to eliminate long-term credentials like passwords. The community consensus strongly supports IAM database authentication as the correct approach for short-lived, token-based access.

Many candidates choose option B (AWS Secrets Manager) because it supports credential rotation, but fail to recognize that rotated credentials are still considered long-term credentials that exist for extended periods.

Community Discussion (8 comments)

ahadh7621 👍 5 Selected: B
B. "The developer's solution must not use long term credentials" implies that the credentials will be rotated, which SecretsManager supports.
ShakthiGCP 👍 1 Selected: A
Answer is A
MasoudK 👍 2
A. AWS Secrets Manager can store and manage database credentials, and it can automatically rotate these credentials. However, the credentials stored in Secrets Manager are still considered long-term credentials because they exist for a period of time until they are rotated. • IAM Database Authentication: This method allows you to use IAM roles and policies to manage access to the RDS instance. It uses temporary security credentials provided by IAM roles, which are short-lived and automatically rotated.
albert_kuo 👍 1 Selected: A
aws rds modify-db-instance \ --db-instance-identifier mydbinstance \ --enable-iam-database-authentication \ --apply-immediately { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "rds-db:connect", "Resource": "arn:aws:rds-db:us-west-2:123456789012:dbuser:db-ABCDEFGHIJKLMNOPQRSTUVWX/db_user" } ] }
wh1t4k3r 👍 2 Selected: A
User/pass is a long term credential. IAM db auth allows connection to the database without user/pass, which solves the problem.
siheom 👍 1 Selected: A
VOTE A
minime 👍 2
A. "Amazon RDS for MySQL can use AWS Identity and Access Management (IAM) database authentication to allow users to connect to a DB instance without a password. Instead, users can use an authentication token, which is a unique string of characters generated by Amazon RDS on request. Each token is valid for 15 minutes and is generated using AWS Signature Version 4."
albert_kuo 👍 4 Selected: A
A. Enable IAM database authentication on the RDS for MySQL DB instance. Create an IAM role that has the minimum required permissions. Assign the role to the application.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Understanding the Core Requirement

The critical phrase in this question is "must not use long term credentials." This requirement immediately eliminates traditional username/password authentication methods, even when those credentials are stored securely or rotated automatically.

Why Option A is Correct

IAM database authentication for Amazon RDS for MySQL allows applications to connect to the database using authentication tokens instead of static passwords. These tokens are:

  • Generated on-demand using AWS Signature Version 4
  • Valid for only 15 minutes
  • Completely eliminate the need for stored database passwords
  • Managed through IAM roles and policies
The implementation requires: 1. Enabling IAM database authentication on the RDS instance 2. Creating an IAM role with rds-db:connect permissions 3. Assigning the role to the application (EC2 instance profile, ECS task role, or Lambda execution role)

Why Other Options Fail

Option B (Secrets Manager): While Secrets Manager can automatically rotate credentials, the rotated credentials are still long-term credentials that exist for days, weeks, or months. The question explicitly requires avoiding long-term credentials entirely.

Option C (Environment Variables): This approach uses static credentials that are long-term and presents additional security risks by exposing credentials in configuration.

Option D (Parameter Store): Similar to Secrets Manager, this stores long-term credentials, just in a different AWS service. The credentials remain valid until manually changed.

Community Insights

As noted by community members, the key distinction is that IAM database authentication uses ephemeral tokens (15-minute validity) rather than persistent credentials. This is the only solution that truly eliminates long-term credential storage and management.

Official Reference

Exam Strategy

When you see 'no long-term credentials' or 'short-lived credentials' in AWS exam questions, immediately think of IAM-based authentication methods that use temporary tokens or credentials. Distinguish between credential rotation (still long-term) and credential elimination (truly short-lived).

Related Analysis

A developer manages a website that distributes its content b

A-Grade

A gaming website gives users the ability to trade game items

A-Grade

A company is building an application on AWS. The application

A-Grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide