Automate Database Credential Rotation with AWS Secrets Manager

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Use AWS Secrets Manager to create a secret associated with the Aurora cluster, encrypted with KMS, and configure a custom 14-day rotation period.

Question

A company hosts a multi-tier web application that uses an Amazon Aurora MySQL DB cluster for storage. The application tier is hosted on Amazon EC2 instances. The company's IT security guidelines mandate that the database credentials be encrypted and rotated every 14 days. What should a solutions architect do to meet this requirement with the LEAST operational effort?
  1. Create a new AWS Key Management Service (AWS KMS) encryption key. Use AWS Secrets Manager to create a new secret that uses the KMS key with the appropriate credentials. Associate the secret with the Aurora DB cluster. Configure a custom rotation period of 14 days. Correct Answer
  2. Create two parameters in AWS Systems Manager Parameter Store: one for the user name as a string parameter and one that uses the SecureString type for the password. Select AWS Key Management Service (AWS KMS) encryption for the password parameter, and load these parameters in the application tier. Implement an AWS Lambda function that rotates the password every 14 days.
  3. Store a file that contains the credentials in an AWS Key Management Service (AWS KMS) encrypted Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in all EC2 instances of the application tier. Restrict the access to the file on the file system so that the application can read the file and that only super users can modify the file. Implement an AWS Lambda function that rotates the key in Aurora every 14 days and writes new credentials into the file.
  4. Store a file that contains the credentials in an AWS Key Management Service (AWS KMS) encrypted Amazon S3 bucket that the application uses to load the credentials. Download the file to the application regularly to ensure that the correct credentials are used. Implement an AWS Lambda function that rotates the Aurora credentials every 14 days and uploads these credentials to the file in the S3 bucket.

Key Takeaways

The question tests knowledge of managed credential services versus custom implementations; the trap is choosing manual rotation methods that require significant code maintenance.

This page explains how to securely manage and rotate Amazon Aurora MySQL credentials using AWS Secrets Manager to meet strict security mandates with minimal operational overhead.

Common mistake: Candidates often select options involving Systems Manager Parameter Store or S3/EFS because they are familiar storage mechanisms, failing to recognize that these require building and maintaining custom Lambda functions for rotation logic.

Expert Analysis

Why the Answer Is Correct

AWS Secrets Manager is the native service designed specifically for storing secrets like database credentials. It provides built-in integration with Amazon Aurora, allowing you to associate a secret directly with the DB cluster. The key feature here is the ability to configure a custom rotation schedule (every 14 days) without writing the underlying rotation logic from scratch, as AWS provides pre-built Lambda functions for major databases like Aurora. This satisfies the requirement for encryption (via KMS) and automated rotation with the least operational effort.

Why the Other Options Are Wrong

Option B involves Systems Manager Parameter Store. While it supports SecureString and KMS encryption, it does not have built-in automatic rotation capabilities for database credentials; you would need to write and maintain a custom Lambda function to handle the rotation logic, increasing operational effort. Options C and D suggest storing credentials in files on EFS or S3. These are static storage solutions that do not integrate with database authentication systems natively. Implementing rotation here requires complex custom scripts to update the file and ensure application reloads, which is error-prone and high-effort compared to Secrets Manager.

Community Comment Notes

Community consensus strongly favors Option A, citing the direct association between Secrets Manager and Aurora clusters. Users note that while Parameter Store is good for configuration data, Secrets Manager is the specialized tool for secrets requiring rotation. Comments emphasize that 'manual implementation' in other options contradicts the 'least operational effort' constraint.

Official Reference

https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked for 'least operational effort' regarding credentials, always look for AWS Secrets Manager first. If the question involves parameters/config, look for Systems Manager Parameter Store. Never choose file-based storage (S3/EFS) for active database credentials unless absolutely necessary.

Frequently Asked Questions

Why not use Systems Manager Parameter Store for password rotation?

Parameter Store does not have built-in automatic rotation for database credentials. You must write and maintain custom Lambda code to rotate the password, which increases operational effort.

Can I rotate Aurora credentials manually without Secrets Manager?

Yes, but it is high-effort. You would need to manage the lifecycle of the credentials, update connection strings in your application, and ensure security compliance manually.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. viejito 👍 2
    respuesta correcta A . Credenciales , rotación automática =AWS Secrets Manager .
  2. LeonSauveterre 👍 1 Answered A
    A - AWS KMS + Secrets Manager support custom rotation intervals, such as 14 days, with built-in integration for Aurora DB clusters. B, C, D - Manual implementation of rotation? This is really hard.
  3. aragon_saa 👍 2 Answered A
    Answer is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide