Minimizing Credential Overhead for EC2 and Aurora

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Determine appropriate data security controls.

Short answer

A Use AWS Secrets Manager with automatic rotation enabled so EC2 instances fetch fresh Aurora user names and passwords without manual file maintenance.

Question

A company has an application that runs on Amazon EC2 instances and uses an Amazon Aurora database. The EC2 instances connect to the database by using user names and passwords that are stored locally in a file. The company wants to minimize the operational overhead of credential management.
What should a solutions architect do to accomplish this goal?
  1. Use AWS Secrets Manager. Turn on automatic rotation. Correct Answer
  2. Use AWS Systems Manager Parameter Store. Turn on automatic rotation.
  3. Create an Amazon S3 bucket to store objects that are encrypted with an AWS Key Management Service (AWS KMS) encryption key. Migrate the credential file to the S3 bucket. Point the application to the S3 bucket.
  4. Create an encrypted Amazon Elastic Block Store (Amazon EBS) volume for each EC2 instance. Attach the new EBS volume to each EC2 instance. Migrate the credential file to the new EBS volume. Point the application to the new EBS volume.

Key Takeaways

The question tests which AWS service can both store and automatically rotate database credentials, and the common trap is assuming Parameter Store offers native rotation or that re-hosting the file on S3/EBS reduces management effort.

This SAA-C03 scenario asks how an EC2-hosted application should stop storing Aurora user names and passwords in a local file while cutting credential-management overhead. AWS Secrets Manager with automatic rotation is the correct answer (A), because it centrally stores, encrypts, and rotates database credentials without manual intervention.

Common mistake: Option B is the most common wrong pick because learners associate Parameter Store with secrets, but it has no built-in rotation capability unless you build and run your own Lambda-based rotation logic yourself.

Expert Analysis

Why the Answer Is Correct

AWS Secrets Manager is purpose-built to store, retrieve, and rotate credentials throughout their lifecycle, and it ships with native rotation support for Amazon Aurora, Amazon RDS MySQL/PostgreSQL and other engines via a Lambda rotation function. Turning on automatic rotation removes the manual cycle of updating the local credential file, so the EC2 application simply calls GetSecretValue at runtime and always receives fresh, KMS-encrypted credentials. This directly satisfies the stated goal of minimizing operational overhead of credential management while eliminating the plaintext file on disk. As hro noted, "Aurora manages the settings for the secret and rotates the secret every seven days by default."

Why the Other Options Are Wrong

Option B fails because Systems Manager Parameter Store does not support automatic rotation natively; as Sinaneos stated, "parameter store does not support auto rotation, unless the customer writes it themselves." Option C merely relocates the same credential file into an S3 object, which still requires the application to fetch and parse a static file, adds an S3 dependency, and ogerber warned "never store credentials on buckets, its a hazard." Option D is equally weak: an encrypted EBS volume is still a locally mounted file per instance, so every rotation forces manual file updates on each EC2 instance and multiplies operational work instead of reducing it.

Community Comment Notes

The comment thread converges strongly on A, with PhucVuu framing the trade-off as "Improve security with lowest operational overhead" and KVK16 pointing to Secrets Manager's "built-in integrations for MySQL, PostgreSQL, and Amazon Aurora." cookieMr emphasized that the application "can retrieve the database credentials programmatically at runtime," which matches the recommended integration pattern. Abishek016 summarized the consensus that automatic rotation "ensures that the EC2 instances retrieve the most recent credentials securely." One commenter, NaaVeeN, questioned how answers get marked correct, which is a workflow concern rather than a technical one.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question says to minimize operational overhead around credentials, immediately look for automatic rotation — Secrets Manager is the only AWS service offering it natively for RDS/Aurora. Eliminate any option that keeps the secret in a file-like store, since relocation to S3 or EBS does not reduce rotation work.

Frequently Asked Questions

Why can't I use Parameter Store to rotate the Aurora credentials automatically?

Parameter Store has no built-in rotation engine for database credentials. You would have to author, deploy, and maintain your own Lambda rotation function, which defeats the goal of minimizing operational overhead.

Why is moving the credential file to an S3 bucket or EBS volume not enough?

S3 and EBS only relocate the stored file; the application still reads static credentials and someone must still update the file on every rotation. Neither service performs automatic credential rotation for you.

More SAA-C03 FAQ →

Discussion 105 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 105

  1. Sinaneos 👍 107 Answered A
    B is wrong because parameter store does not support auto rotation, unless the customer writes it themselves, A is the answer.
  2. 17Master 👍 35 Answered A
    READ!!! AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.
  3. cookieMr 👍 8 Answered A
    Option A: Using AWS Secrets Manager and enabling automatic rotation is the recommended solution for minimizing the operational overhead of credential management. AWS Secrets Manager provides a secure and centralized service for storing and managing secrets, such as database credentials. By leveraging Secrets Manager, the application can retrieve the database credentials programmatically at runtime, eliminating the need to store them locally in a file. Enabling automatic rotation ensures that the database credentials are regularly rotated without manual intervention, enhancing security and compliance.
  4. hro 👍 5
    A - additionally, Aurora manages the settings for the secret and rotates the secret every seven days by default.
  5. KVK16 👍 4 Answered A
    AWS Secrets Manager, a service that makes it easier to rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. You can configure Secrets Manager to rotate secrets automatically, which can help you meet your security and compliance needs. Secrets Manager offers built-in integrations for MySQL, PostgreSQL, and Amazon Aurora on Amazon RDS, and can rotate credentials for these databases natively. You can control access to your secrets by using fine-grained AWS Identity and Access Management (IAM) policies. To retrieve secrets, employees replace plaintext secrets with a call to Secrets Manager APIs, eliminating the need to hard-code secrets in source code or update configuration files and redeploy code when secrets are rotated.
Show 25 more comments
  1. PhucVuu 👍 4 Answered A
    Keywords: - User names and passwords that are stored locally in a file -> minimize the operational overhead of credential management. (Improve security with lowest operational overhead) A: Correct - with AWS Secret Manager the the username and password will be encrypted with KMS and it also has the automatic rotation. B: Incorrect - AWS Systems Manager Parameter Store don't have automatic rotation C: Incorrect - Actually, we can apply this but we will do a lot of things compare to AWS Secret Manager. D: Incorrect - We can do this but it is required more operational overhead than AWS Secret Manager
  2. ogerber 👍 4 Answered A
    no rotation option on parameter store. never store credentials on buckets, its a hazard. its A!!
  3. NaaVeeN 👍 4
    If most Voted answers is done by us, then Who is marking the answers as Correct ?
  4. Buruguduystunstugudunstuy 👍 3 Answered A
    Option A, using AWS Secrets Manager and turning on automatic rotation, would be the best solution to minimize the operational overhead of credential management. AWS Secrets Manager is a service that makes it easier to manage secrets, such as database credentials, by storing and rotating them automatically. By turning on automatic rotation, you can ensure that the secrets are regularly rotated, reducing the risk of unauthorized access to the database. This would minimize the operational overhead of credential management, as you would not have to manually rotate the secrets or update the EC2 instances with the new credentials.
  5. jallaix 👍 3
    Everybody here voting A, but only the master user's password of the Aurora database can be automatically stored and rotated. Who uses the master user's credentials in their application ? It looks to me like a serious security issue... Moreover answer A is not complete, missing steps are: - create IAM role to get secret - assign IAM role to EC2 instance - adapt the application to retrieve the secret from Secrets Manager instead of erading the file - make sure retrieval occurs every week I dont' call that minimizing operational overhead... Answer D is a lot more simple. In a real situation, none of these answers are relevant.
  6. Azaa 👍 3 Answered A
    From the AWS doc it clearly saying choose AWS Secrets manager if it requires auto rotation ``` To implement password rotation lifecycles, use AWS Secrets Manager. You can rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle using Secrets Manager. For more information, see What is AWS Secrets Manager? in the AWS Secrets Manager User Guide.
  7. jdr75 👍 3
    CORRECT IS A, not B, and it's evident. Again Examtopis offers the incorrect anwer as the correct. Who is responsible of choosing the incorrect answer in a public community thread as the correct one? -- someone should think about this, because it's not serious.
  8. Mandar15 👍 3 Answered A
    Aurora automatically stores and manages database credentials in AWS Secrets Manager. Aurora rotates database credentials regularly, without requiring application changes. Secrets Manager secures database credentials from human access and plain text view.
  9. Abishek016 👍 3 Answered A
    This is an ideal solution. Secrets Manager can rotate credentials automatically and ensures that the EC2 instances retrieve the most recent credentials securely.
  10. ifaby 👍 3 Answered B
    B becasue the user wants reduce costs and SSM Parameter Store layer Standard is free and the type SecureString uses KMS
  11. iCcma 👍 3
    ty bro, I was confused about that and you just mentioned the "key" phrase, B doesn't support autorotation
  12. SilentMilli 👍 2 Answered A
    AWS Secrets Manager is a secrets management service that enables you to store, manage, and rotate secrets such as database credentials, API keys, and SSH keys. Secrets Manager helps you secure your secrets by automatically rotating them according to a schedule that you specify. This can help minimize the operational overhead of managing and rotating secrets, as well as reduce the risk of secrets being compromised. With Secrets Manager, you can store the user names and passwords for your Amazon Aurora database in a central location and have them automatically rotated on a schedule that you specify. The EC2 instances can then retrieve the secrets as needed, rather than having to store them locally in a file.
  13. MGKYAING 👍 2 Answered A
    AWS Secrets Manager: Is a managed service specifically designed to securely store and retrieve secrets, such as database credentials, API keys, and SSH keys. Provides features like automatic rotation, which helps to reduce the risk of compromised credentials. Integrates seamlessly with many AWS services, including Amazon RDS (which Aurora is a part of).
  14. Ruffyit 👍 2
    A: READ!!! AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. It says SSM Parameter store cant rotate automatically.
  15. hypnozz 👍 2
    A is the right choice...Because, in Both you can force to rotate or delete de secrets, but, in secrets manager you can use a lambda to generate automatic secrets, also, it´s integrated with RDS, like Aurora...and it´s mostly used for that propouse. You can use parameter store, but you have to update the parameters by yourself
  16. suhan_14 👍 2 Answered A
    A is correct. AWS secret manager make sense in here with auto rotation to reduce blast radius of leaked cred, as AWS SM is build to store these types of sensitive info. AWS System manager params store is build to storing much less concerning cred like normal url, app config etc.
  17. psr83 👍 2 Answered A
    To implement password rotation lifecycles, use AWS Secrets Manager. You can rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle using Secrets Manager. For more information
  18. aba2s 👍 2 Answered A
    B is wrong because parameter store does not support auto rotation. please see this link at the end https://tutorialsdojo.com/aws-secrets-manager-vs-systems-manager-parameter-store/
  19. wombles 👍 2
    Parameter Store supports automatic rotation through its Secrets Manager integration as per the documentation A - is correct in this scenario.
  20. al20220711 👍 2
    The advantage of Systems Manager over Secrets Manager is costing. But it doesn't mention in the question. SO A is better.
  21. BoboChow 👍 2 Answered A
    AWS Secrets Manager is newer to SSM Parameter Store, and I'm not sure the later one can turn on automatic rotation
  22. CLOUDUMASTER 👍 2
    B sounds logical there is no question saying that auto rotation is supposed to be a key component though
  23. kapalulz 👍 2 Answered A
    parameter store does not support auto rotation and AWS Secrets Manager does.
  24. acuaws 👍 2 Answered B
    B Parameter Store DOES NOT provide automatic rotation.
  25. Kamatchi 👍 2 Answered A
    This is asked in the exam I have taken today

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide