How to Securely Store and Rotate Database Credentials on AWS?

DVA-C02 By islever Editorial Last updated Aug 27, 2026

Short answer

D Migrate the credentials to AWS Secrets Manager. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager by using keys.

Question

A company hosts its application on AWS. The application runs on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The cluster runs behind an Application Load Balancer. The application stores data in an Amazon Aurora database. A developer encrypts and manages database credentials inside the application. The company wants to use a more secure credential storage method and implement periodic credential rotation. Which solution will meet these requirements with the LEAST operational overhead?

Migrate the secret credentials to Amazon RDS parameter groups. Encrypt the parameter by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant AWS KMS permissions to access Amazon RDS.
Migrate the credentials to AWS Systems Manager Parameter Store. Encrypt the parameter by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager.
Migrate the credentials to ECS Fargate environment variables. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager.
Migrate the credentials to AWS Secrets Manager. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager by using keys. Correct Answer

Key Takeaways

Tests knowledge of AWS secret management services, with the common trap being confusion between Parameter Store and Secrets Manager regarding built-in rotation capabilities.

This question evaluates secure credential storage and automated rotation strategies on AWS. The community consensus strongly favors AWS Secrets Manager due to its native rotation features and seamless integration with ECS Fargate and Aurora.

Common mistake: Option B is frequently selected incorrectly because Systems Manager Parameter Store supports encryption but lacks native secret rotation, forcing candidates to overlook the increased operational overhead required to build custom rotation solutions.

Expert Analysis

Why the Answer Is Correct

AWS Secrets Manager is purpose-built for securely storing, retrieving, and automatically rotating database credentials. It integrates natively with Aurora and ECS Fargate, allowing you to grant access via IAM roles without hardcoding or managing rotation logic. Using KMS encryption ensures data at rest and in transit is protected, while built-in rotation schedules eliminate manual intervention, directly satisfying the requirement for least operational overhead.

Why the Other Options Are Wrong

Option A incorrectly uses RDS parameter groups, which are designed for configuration settings rather than sensitive credentials, and completely lack native rotation capabilities. Option B relies on Systems Manager Parameter Store, which requires custom Lambda functions and additional IAM configurations to achieve rotation, significantly increasing operational overhead compared to Secrets Manager. Option C suggests using Fargate environment variables, which violates security best practices by exposing secrets in task definitions and offers no centralized storage or automated rotation mechanism.

Community Comment Notes

The community unanimously recommends Secrets Manager for this scenario, noting it is the industry standard for database credential management [Comment 1]. Multiple users point out that while Parameter Store supports encryption, it fails the rotation requirement without heavy custom scripting [Comment 2]. Several commenters also confirm that environment variables and parameter groups are fundamentally misaligned with the security and automation goals outlined in the prompt [Comment 4].

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Distinguish between AWS services by evaluating their native capabilities rather than focusing solely on encryption features. When questions specify automated rotation and minimal operational overhead, immediately select AWS Secrets Manager over Parameter Store or custom workarounds.

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

tgv 👍 4

the most secure + secrets rotation --> Secrets Manager
KarBiswa 👍 4 Answered D

Always secrets manager for credential
nder 👍 3 Answered D

If it's secrets manager its for db
CrescentShared 👍 3 Answered D

C is not correct.
monishvster 👍 3 Answered D

Secrets Manager

Show 1 more comment

65703c1 👍 2 Answered D

D is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide