How to Rotate Third-Party API Tokens Every 3 Months on AWS?
A company has an application that uses different APIs to generate embeddings for input text. The company needs to implement a solution to automatically rotate the API tokens every 3 months. Which solution will meet this requirement?
Community Insight
This question tests which AWS service offers built-in, schedulable secret rotation for external credentials — the trap is confusing KMS key rotation (encryption keys only) or Parameter Store storage with actual API-token rotation.
Third-party embedding API tokens that must be rotated on a 3-month schedule are best stored in AWS Secrets Manager, which natively supports scheduled rotation through a Lambda rotation function. This page confirms why option A meets the requirement while Parameter Store and KMS keys do not.
Picking AWS Systems Manager Parameter Store because it can store the tokens and integrates with Lambda; storing is not rotating — Parameter Store has no native rotation scheduler for external provider tokens, so the 3-month cadence would have to be built entirely by hand.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Secrets Manager is purpose-built for storing and rotating credentials, and rotation is a first-class feature: you attach a Lambda rotation function to the secret and define a schedule such as every 3 months. Because the tokens belong to an external embedding provider, the rotation function is what calls that provider's token-issuance API, writes the new token back to the secret, and can even test it before committing. Secrets Manager then invokes that function on the configured schedule (for example, a 90-day rotation window) with no extra orchestration on the company's side. That combination of managed secret storage plus Lambda-driven rotation is exactly what the requirement asks for.Why the Other Options Are Wrong
Option B fails because Parameter Store is a configuration/parameter store: it can hold the token as a SecureString, but it provides no rotation engine, so every 3 months someone would need custom EventBridge and Lambda plumbing. Options C and D fail at the first step — KMS is an encryption-key service and does not store API tokens at all. AWS managed keys (C) and AWS owned keys (D) have automatic key-material rotation that is managed by AWS and cannot be scheduled or repurposed to rotate a third-party API token every 3 months. Neither key type lets you bring your own rotation logic.Community Comment Notes
All three commenters converged on the same option: GiorgioGss simply notes that "Secret manager has automatic rotation", and rinip86277 agrees that AWS Secrets Manager is "specifically built for this exact use case." The most precise point comes from 78e659d, who explains that Secrets Manager handles credential storage with scheduled rotation, but third-party API tokens still need a Lambda rotation function because Secrets Manager cannot natively call an external provider's rotation API. That nuance is exactly why the Lambda half of option A is essential and not decorative.Official Reference
Exam Strategy
When a stem mentions periodic rotation of a credential, scan the options for Secrets Manager first — it is the only service with native scheduled rotation. Then confirm that a Lambda rotation function is present, because non-native secrets always require custom rotation logic.
Frequently Asked Questions
Why can't Parameter Store meet the 3-month rotation requirement?
Parameter Store can hold the tokens as SecureString values but has no built-in rotation scheduler, so you would have to build and maintain the entire rotation workflow yourself.
Why is a KMS AWS managed key or AWS owned key wrong for rotating API tokens?
KMS only manages encryption keys, not arbitrary secrets like API tokens, and its automatic key rotation cannot be scheduled to call an external embedding provider every 3 months.
Related Analysis
Practice All MLA-C01 Questions
Access 115 questions with complete answers and detailed explanations.
View Full MLA-C01 Practice Test →