How to Securely Store and Rotate Database Credentials on AWS?
A company hosts its application on AWS. The application runs on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The cluster runs behind an Application Load Balancer. The application stores data in an Amazon Aurora database. A developer encrypts and manages database credentials inside the application. The company wants to use a more secure credential storage method and implement periodic credential rotation. Which solution will meet these requirements with the LEAST operational overhead?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests knowledge of AWS secret management services, with the common trap being confusion between Parameter Store and Secrets Manager regarding built-in rotation capabilities.
This question evaluates secure credential storage and automated rotation strategies on AWS. The community consensus strongly favors AWS Secrets Manager due to its native rotation features and seamless integration with ECS Fargate and Aurora.
Option B is frequently selected incorrectly because Systems Manager Parameter Store supports encryption but lacks native secret rotation, forcing candidates to overlook the increased operational overhead required to build custom rotation solutions.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Secrets Manager is purpose-built for securely storing, retrieving, and automatically rotating database credentials. It integrates natively with Aurora and ECS Fargate, allowing you to grant access via IAM roles without hardcoding or managing rotation logic. Using KMS encryption ensures data at rest and in transit is protected, while built-in rotation schedules eliminate manual intervention, directly satisfying the requirement for least operational overhead.Why the Other Options Are Wrong
Option A incorrectly uses RDS parameter groups, which are designed for configuration settings rather than sensitive credentials, and completely lack native rotation capabilities. Option B relies on Systems Manager Parameter Store, which requires custom Lambda functions and additional IAM configurations to achieve rotation, significantly increasing operational overhead compared to Secrets Manager. Option C suggests using Fargate environment variables, which violates security best practices by exposing secrets in task definitions and offers no centralized storage or automated rotation mechanism.Community Comment Notes
The community unanimously recommends Secrets Manager for this scenario, noting it is the industry standard for database credential management [Comment 1]. Multiple users point out that while Parameter Store supports encryption, it fails the rotation requirement without heavy custom scripting [Comment 2]. Several commenters also confirm that environment variables and parameter groups are fundamentally misaligned with the security and automation goals outlined in the prompt [Comment 4].Official Reference
Exam Strategy
Distinguish between AWS services by evaluating their native capabilities rather than focusing solely on encryption features. When questions specify automated rotation and minimal operational overhead, immediately select AWS Secrets Manager over Parameter Store or custom workarounds.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →