AWS AppConfig and Secrets Manager for Least Overhead

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Use AWS AppConfig to manage configuration and AWS Secrets Manager to store and retrieve credentials securely.

Question

A company is building an application on AWS that connects to an Amazon RDS database. The company wants to manage the application configuration and to securely store and retrieve credentials for the database and other services. Which solution will meet these requirements with the LEAST administrative overhead?
  1. Use AWS AppConfig to store and manage the application configuration. Use AWS Secrets Manager to store and retrieve the credentials. Correct Answer
  2. Use AWS Lambda to store and manage the application configuration. Use AWS Systems Manager Parameter Store to store and retrieve the credentials.
  3. Use an encrypted application configuration file. Store the file in Amazon S3 for the application configuration. Create another S3 file to store and retrieve the credentials.
  4. Use AWS AppConfig to store and manage the application configuration. Use Amazon RDS to store and retrieve the credentials.

Key Takeaways

It tests the distinction between specialized management tools (AppConfig, Secrets Manager) versus generic storage or compute resources, highlighting that dedicated services reduce operational burden.

This question evaluates the optimal AWS services for managing application configuration and securely handling database credentials with minimal administrative overhead.

Common mistake: Candidates often select Parameter Store because it is free, ignoring that Secrets Manager provides built-in rotation capabilities which significantly reduce administrative overhead for credentials.

Expert Analysis

Why the Answer Is Correct

Option A is correct because AWS AppConfig is purpose-built for deploying and managing application configuration data, while AWS Secrets Manager is designed specifically for storing, retrieving, and automatically rotating sensitive data like database credentials. Using these managed services eliminates the need to write custom code for configuration fetching or credential rotation, thereby achieving the least administrative overhead.

Why the Other Options Are Wrong

Option B is incorrect because Lambda is a compute service, not a configuration store, making it an inappropriate choice for storing static or dynamic config files. Option C involves manual management of encrypted files in S3, requiring custom logic for access control, encryption key management, and retrieval, which creates high administrative overhead. Option D suggests using RDS to store credentials, which violates security best practices by mixing operational data with application secrets and adds unnecessary database complexity.

Community Comment Notes

Community consensus strongly supports Option A, with users noting that AppConfig integrates well with various backends but requires a dedicated service for robust configuration management. Comments highlight that using RDS for credentials (Option D) is a poor practice and that Secrets Manager is the standard for secure credential handling due to its automation features.

Exam Strategy

Always look for managed services that automate routine tasks like rotation and versioning when 'least administrative overhead' is requested. Avoid using generic storage (S3) or compute (Lambda) for purposes where specialized services (AppConfig, Secrets Manager) exist.

Frequently Asked Questions

Why not use Systems Manager Parameter Store for credentials?

Parameter Store can store secrets, but Secrets Manager offers automatic rotation and auditing out-of-the-box, reducing admin overhead for database credentials.

Is AppConfig only for feature flags?

No, AppConfig is a general-purpose configuration management service that can deploy any type of application setting, not just feature flags.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. BillaRanga 👍 10 Answered A
    AppConfig useCase = You can use AWS AppConfig to deploy configuration data stored in the AWS AppConfig hosted configuration store, AWS Secrets Manager, Systems Manager Parameter Store, or Amazon S3. So B and C are out. use RDS to store credentials is not a good practise. So D is out. Ans is A
  2. Andy_09 👍 8
    Option A
  3. Awsbeginner87 👍 3
    Credentials= secrets Manager

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide