Least Effort Way to Rotate AWS Secrets for EC2 Startup?
A company runs a payment application on Amazon EC2 instances behind an Application Load Balance. The EC2 instances run in an Auto Scaling group across multiple Availability Zones. The application needs to retrieve application secrets during the application startup and export the secrets as environment variables. These secrets must be encrypted at rest and need to be rotated every month. Which solution will meet these requirements with the LEAST development effort?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your understanding of AWS Secrets Manager's built-in rotation feature versus manual or Lambda-based rotation in Parameter Store; the trap is assuming Parameter Store is equivalent for automatic rotation.
For EC2 applications needing encrypted, monthly-rotated secrets as environment variables, AWS Secrets Manager with automatic rotation is the least-effort solution. Community consensus strongly favors option D because Secrets Manager handles rotation natively, unlike Parameter Store.
Option B (Parameter Store) is the most common wrong answer because it can store secrets and retrieve them via user data, but it lacks native automatic rotation, requiring a custom Lambda function and thus more development effort.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D is correct because AWS Secrets Manager is purpose-built for storing and rotating secrets. It provides automatic rotation with a single click or API call, eliminating the need to write custom rotation logic. The EC2 user data script can retrieve secrets programmatically and export them as environment variables, satisfying the startup requirement. Secrets are encrypted at rest using a customer master key (CMK), and monthly rotation can be configured directly in Secrets Manager, meeting all requirements with minimal effort.
Community comments reinforce this: one commenter simply notes "rotation --> AWS Secrets Manager" (comment [1]), and another provides a clean user data script using the AWS CLI to fetch and export the secret (comment [2]). The high vote count for D (100%) shows broad consensus that Secrets Manager is the intended service for this scenario.
Why the Other Options Are Wrong
Option A (S3 + Object Lambda) is wrong because S3 is not designed for secret storage; Object Lambda is for transforming data on-the-fly, not rotating secrets, and this approach requires significant custom engineering. Option B (Parameter Store) stores secrets but has no native automatic rotation; you would need to build and manage an AWS Lambda rotation function, increasing development effort compared to Secrets Manager. Option C (base64 env vars in application properties) is insecure and does not encrypt secrets at rest or provide any rotation mechanism, making it completely invalid.
Community Comment Notes
Comments are unanimous for D, with several users simply stating "D is right" (comments [3], [4], [6]). One commenter emphasizes the keyword "rotated" (comment [5]), indicating that the presence of rotation in the requirement is the deciding factor. Another provides a practical example of the user data script (comment [2]), confirming that the retrieval mechanism is straightforward with the AWS CLI. No comment defends B, which suggests that even those who might consider Parameter Store realize it lacks the built-in rotation capability that Secrets Manager offers.
Official Reference
Exam Strategy
When you see 'rotate' plus 'least effort' in a secrets question, immediately think of AWS Secrets Manager's automatic rotation feature. Remember that Parameter Store can store secrets but requires custom rotation logic, so it is rarely the correct answer for a rotation-focused scenario.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →