Secure Credential Management for RDS with Minimal Effort

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Store the credentials in AWS Secrets Manager and configure automatic rotation using a Lambda function provided by the service.

Question

A company has a custom application with embedded credentials that retrieves information from a database in an Amazon RDS for MySQL DB cluster. The company needs to make the application more secure with minimal programming effort. The company has created credentials on the RDS for MySQL database for the application user. Which solution will meet these requirements?
  1. Store the credentials in AWS Key Management Service (AWS KMS). Create keys in AWS KMS. Configure the application to load the database credentials from AWS KMS. Enable automatic key rotation
  2. Store the credentials in encrypted local storage. Configure the application to load the database credentials from the local storage. Set up a credentials rotation schedule by creating a cron job.
  3. Store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule by creating an AWS Lambda function for Secrets Manager. Correct Answer
  4. Store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule in the RDS for MySQL database by using Parameter Store.

Key Takeaways

The core concept is replacing hardcoded secrets with a managed service that supports automatic rotation, specifically distinguishing between Secrets Manager and Parameter Store capabilities.

This question addresses how to securely manage embedded database credentials in an Amazon RDS application while minimizing programming effort using AWS Secrets Manager.

Common mistake: Candidates often choose Option D (Parameter Store) because it is free and secure, but they overlook that Parameter Store does not natively support automatic credential rotation without custom coding, violating the 'minimal programming effort' requirement.

Expert Analysis

Why the Answer Is Correct

AWS Secrets Manager is explicitly designed for storing and rotating sensitive data like database credentials. It integrates directly with RDS to handle automatic rotation via Lambda functions configured within the service, requiring no custom code from the developer to manage the rotation logic itself. This perfectly satisfies the requirement for minimal programming effort while enhancing security by removing hardcoded credentials.

Why the Other Options Are Wrong

Option A uses KMS, which is for encryption key management, not for storing and rotating application credentials. Option B relies on local storage and manual cron jobs, which increases security risk and operational overhead. Option D uses Parameter Store, which stores secrets securely but lacks native automatic rotation features; implementing rotation would require significant custom development, contradicting the 'minimal effort' constraint.

Community Comment Notes

The community consensus strongly favors Option C, with users noting that Secrets Manager provides built-in support for automatic rotation unlike Parameter Store. As LeonSauveterre noted, "A - AWS KMS is used for encryption... not for storing and rotating credentials," highlighting the distinct roles of these services. Another user pointed out that Parameter Store doesn't provide automatic rotation, reinforcing why D is incorrect despite its popularity.

Official Reference

https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_rotate_secrets_self.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about credential management, always check if the question specifies 'automatic rotation.' If it does and mentions 'minimal effort,' AWS Secrets Manager is almost certainly the correct answer over Parameter Store, as Parameter Store requires custom Lambda code for rotation.

Frequently Asked Questions

Why not use Parameter Store for secret rotation?

Parameter Store stores secrets securely but does not have a built-in feature for automatic rotation. You must write custom Lambda code and logic to rotate them, which violates the 'minimal programming effort' requirement.

Is KMS used for storing database passwords?

No. KMS is used to encrypt data, including the secrets stored in other services like Secrets Manager. It does not store or manage the lifecycle of database credentials themselves.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. [Removed] 👍 5 Answered C
    C Explanation: AWS Secrets Manager is designed specifically for managing and automatically rotating credentials, including database credentials, API keys, and other secrets. It provides a secure and centralized place to store credentials and allows applications to retrieve them securely without hardcoding them in the application. Secrets Manager also offers built-in support for automatic rotation of credentials using Lambda functions, which reduces the manual effort needed for rotation and enhances security. This approach requires minimal programming effort because the application only needs to be configured to retrieve the credentials from Secrets Manager instead of being embedded within the application code.
  2. LeonSauveterre 👍 2 Answered C
    A - AWS KMS is used for encryption and key management, not for storing and rotating credentials themselves. B - Why manually set up a cron job? C - Securely stores and manages sensitive information such as credentials, and provides native support for automatic rotation. D - Parameter Store doesn't provide automatic rotation.
  3. Omshanti 👍 2 Answered C
    AWS Secret manager securely stores data base user id and passwords
  4. Anyio 👍 1 Answered C
    The correct answer is C. Store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule by creating an AWS Lambda function for Secrets Manager. Explanation: Option C: Correct. AWS Secrets Manager is designed to securely store, manage, and retrieve database credentials. It supports automatic credentials rotation for Amazon RDS databases with minimal programming effort. Secrets Manager can automatically rotate the Amazon RDS database credentials using a built-in Lambda function, providing an integrated and secure solution for handling credentials.
  5. komorebi 👍 2 Answered C
    Answer is C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide