How to Rotate Third-Party API Tokens Every 3 Months on AWS?

MLA-C01 By islever Editorial Last updated

Secure AWS resources.

Short answer

A Store the embedding API tokens in AWS Secrets Manager and use a Lambda rotation function to rotate the tokens every 3 months.

Question

A company has an application that uses different APIs to generate embeddings for input text. The company needs to implement a solution to automatically rotate the API tokens every 3 months.
Which solution will meet this requirement?
  1. Store the tokens in AWS Secrets Manager. Create an AWS Lambda function to perform the rotation. Correct Answer
  2. Store the tokens in AWS Systems Manager Parameter Store. Create an AWS Lambda function to perform the rotation.
  3. Store the tokens in AWS Key Management Service (AWS KMS). Use an AWS managed key to perform the rotation.
  4. Store the tokens in AWS Key Management Service (AWS KMS). Use an AWS owned key to perform the rotation.

Key Takeaways

This question tests which AWS service offers built-in, schedulable secret rotation for external credentials — the trap is confusing KMS key rotation (encryption keys only) or Parameter Store storage with actual API-token rotation.

Third-party embedding API tokens that must be rotated on a 3-month schedule are best stored in AWS Secrets Manager, which natively supports scheduled rotation through a Lambda rotation function. This page confirms why option A meets the requirement while Parameter Store and KMS keys do not.

Common mistake: Picking AWS Systems Manager Parameter Store because it can store the tokens and integrates with Lambda; storing is not rotating — Parameter Store has no native rotation scheduler for external provider tokens, so the 3-month cadence would have to be built entirely by hand.

Expert Analysis

Why the Answer Is Correct

AWS Secrets Manager is purpose-built for storing and rotating credentials, and rotation is a first-class feature: you attach a Lambda rotation function to the secret and define a schedule such as every 3 months. Because the tokens belong to an external embedding provider, the rotation function is what calls that provider's token-issuance API, writes the new token back to the secret, and can even test it before committing. Secrets Manager then invokes that function on the configured schedule (for example, a 90-day rotation window) with no extra orchestration on the company's side. That combination of managed secret storage plus Lambda-driven rotation is exactly what the requirement asks for.

Why the Other Options Are Wrong

Option B fails because Parameter Store is a configuration/parameter store: it can hold the token as a SecureString, but it provides no rotation engine, so every 3 months someone would need custom EventBridge and Lambda plumbing. Options C and D fail at the first step — KMS is an encryption-key service and does not store API tokens at all. AWS managed keys (C) and AWS owned keys (D) have automatic key-material rotation that is managed by AWS and cannot be scheduled or repurposed to rotate a third-party API token every 3 months. Neither key type lets you bring your own rotation logic.

Community Comment Notes

All three commenters converged on the same option: GiorgioGss simply notes that "Secret manager has automatic rotation", and rinip86277 agrees that AWS Secrets Manager is "specifically built for this exact use case." The most precise point comes from 78e659d, who explains that Secrets Manager handles credential storage with scheduled rotation, but third-party API tokens still need a Lambda rotation function because Secrets Manager cannot natively call an external provider's rotation API. That nuance is exactly why the Lambda half of option A is essential and not decorative.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a stem mentions periodic rotation of a credential, scan the options for Secrets Manager first — it is the only service with native scheduled rotation. Then confirm that a Lambda rotation function is present, because non-native secrets always require custom rotation logic.

Frequently Asked Questions

Why can't Parameter Store meet the 3-month rotation requirement?

Parameter Store can hold the tokens as SecureString values but has no built-in rotation scheduler, so you would have to build and maintain the entire rotation workflow yourself.

Why is a KMS AWS managed key or AWS owned key wrong for rotating API tokens?

KMS only manages encryption keys, not arbitrary secrets like API tokens, and its automatic key rotation cannot be scheduled to call an external embedding provider every 3 months.

More MLA-C01 FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. GiorgioGss 👍 3 Answered A
    Secret manager has automatic rotation
  2. rinip86277 👍 2 Answered A
    AWS Secrets Manager is specifically built for this exact use case.
  3. 78e659d 👍 1 Answered A
    Secrets Manager is built for credential storage with scheduled rotation, and third-party API tokens need a Lambda rotation function because Secrets Manager can't natively call an external provider's rotation API

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Choosing LightGBM in SageMaker for Fraud Detection with Class Imbalance and Correlated Features

S-grade

Processing Mixed CSV JSON XLSX Parquet Files in One S3 Folder with DataBrew and Outputting Apache Parquet

S-grade

Rebuilding the Model Monitor Baseline After a Model Update Causes Data Quality Violations

S-grade

Orchestrating SageMaker ML Workflows as DAGs in Studio with ML Lineage Tracking for Governance

S-grade

Practice All MLA-C01 Questions

Access 115 questions with complete answers and detailed explanations.

View Full MLA-C01 Practice Test →

← Back to MLA-C01 Study Guide