How to securely store and auto-rotate RDS credentials on EC2?

DVA-C02 By islever Editorial Last updated

Short answer

B Store the credentials as secrets in AWS Secrets Manager. Create an AWS Lambda function to update the secrets and the database. Retrieve the credentials from Secrets Manager as needed.

Question

A company runs an application on Amazon EC2 instances. The EC2 instances open connections to an Amazon RDS for SQL Server database. A developer needs to store and access the credentials and wants to automatically rotate the credentials. The developer does not want to store the credentials for the database in the code. Which solution will meet these requirements in the MOST secure way?
  1. Create an IAM role that has permissions to access the database. Attach the IAM role to the EC2 instances.
  2. Store the credentials as secrets in AWS Secrets Manager. Create an AWS Lambda function to update the secrets and the database. Retrieve the credentials from Secrets Manager as needed. Correct Answer
  3. Store the credentials in an encrypted text file in an Amazon S3 bucket. Configure the EC2 instance launch template to download the credentials from Amazon S3 as the instance launches. Create an AWS Lambda function to update the secrets and the database.
  4. Store the credentials in an Amazon DynamoDB table. Configure an Amazon CloudWatch Events rule to invoke an AWS Lambda function to periodically update the secrets and database.

Key Takeaways

This question tests the candidate's ability to identify the AWS service purpose-built for secure credential storage and automatic rotation, distinguishing it from ad-hoc solutions using S3, DynamoDB, or IAM roles alone.

AWS Secrets Manager is the most secure and native way to store, retrieve, and automatically rotate database credentials for applications running on Amazon EC2. Community consensus overwhelmingly confirms option B as the correct answer.

Common mistake: Many candidates initially lean toward option A (IAM role attached to EC2) because it is a best practice for AWS API access, but IAM roles cannot authenticate to an RDS SQL Server database in place of a username/password credential pair.

Expert Analysis

Why Option B is Correct

AWS Secrets Manager is the AWS service explicitly designed for storing, managing, and automatically rotating secrets such as database credentials, API keys, and OAuth tokens. When paired with an AWS Lambda function, Secrets Manager can rotate the password both in the service itself and in the target database (in this case, Amazon RDS for SQL Server). The EC2 instances then retrieve the credentials at runtime using the Secrets Manager API, ensuring credentials are never hardcoded in the application source code.

Key benefits highlighted by the community:

  • Automatic rotation is a native feature of Secrets Manager.
  • Fine-grained access control via resource-based policies and IAM.
  • Auditability through AWS CloudTrail integration.

Why the Other Options are Incorrect

Option A – Attaching an IAM role to EC2 instances is a best practice for granting AWS API permissions, but it does not provide a username/password for SQL Server authentication. RDS for SQL Server does not support IAM database authentication (unlike RDS for MySQL or PostgreSQL), so an IAM role alone cannot satisfy the requirement.

Option C – Storing credentials in an encrypted S3 object is a manual, fragile approach. S3 has no native secret rotation capability, and downloading credentials at launch via a launch template means the application would need to be restarted or reconfigured each time the secret changes. It also introduces unnecessary complexity and a larger attack surface.

Option D – Using DynamoDB to store credentials requires building a custom rotation mechanism from scratch. DynamoDB is a NoSQL database, not a secrets management service, and lacks built-in encryption-at-rest semantics tailored for secrets, automatic rotation workflows, or fine-grained access policies designed for credential lifecycle management.

Community Insight

Commenters consistently reinforce the keyword association: "rotation → Secrets Manager." As user tgv succinctly noted, the word "rotate" in the question stem is a direct pointer to Secrets Manager. User wh1t4k3r adds that while option B may feel less "practical" in a real-world sense (since AWS now provides built-in rotation templates for RDS), it is the only answer that fully satisfies every requirement stated in the question.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see keywords like 'rotate credentials,' 'store secrets,' or 'no hardcoded passwords,' immediately look for AWS Secrets Manager as the answer. Eliminate options that propose building custom rotation logic on S3 or DynamoDB, as AWS always provides a managed service for this use case.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. wh1t4k3r 👍 3 Answered B
    B is the only one that makes sense, but it is not practical at all.
  2. VKG0507 👍 4
    The ans is B
  3. tgv 👍 3
    rotation --> Secrets Manager
  4. CrescentShared 👍 3 Answered B
    B is correct
  5. 65703c1 👍 2 Answered B
    B is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide