Securely Managing Database Credentials with AWS Secrets Manager

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Store the database credentials as a secret in AWS Secrets Manager and configure automatic rotation to meet security and operational efficiency requirements.

Question

A company runs a Node js function on a server in its on-premises data center. The data center stores data in a PostgreSQL database. The company stores the credentials in a connection string in an environment variable on the server. The company wants to migrate its application to AWS and to replace the Node.js application server with AWS Lambda. The company also wants to migrate to Amazon RDS for PostgreSQL and to ensure that the database credentials are securely managed. Which solution will meet these requirements with the LEAST operational overhead?
  1. Store the database credentials as a parameter in AWS Systems Manager Parameter Store Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter.
  2. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret. Correct Answer
  3. Store the database credentials as an encrypted Lambda environment variable. Write a custom Lambda function to rotate the credentials. Schedule the Lambda function to run every 30 days.
  4. Store the database credentials as a key in AWS Key Management Service (AWS KMS). Configure automatic rotation for the key. Update the Lambda function to retneve the credentials from the KMS key.

Key Takeaways

The key distinction is between Parameter Store (which lacks native rotation) and Secrets Manager (which provides built-in automatic rotation), a common trap where candidates overlook operational overhead requirements.

This question evaluates the best practice for securely managing and rotating database credentials when migrating to AWS Lambda and RDS, identifying AWS Secrets Manager as the solution with the least operational overhead.

Common mistake: Candidates often select Option A because Systems Manager Parameter Store is free and widely used, failing to realize it does not support automatic secret rotation without custom code or third-party tools.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because AWS Secrets Manager is purpose-built for storing sensitive data like database credentials and includes native, automated rotation capabilities. By configuring Secrets Manager to rotate credentials every 30 days, the company eliminates the need for manual intervention or custom scripting, directly satisfying the 'LEAST operational overhead' requirement. This aligns with AWS best practices for securing RDS databases accessed by serverless applications like Lambda.

Why the Other Options Are Wrong

Option A is incorrect because while AWS Systems Manager Parameter Store can encrypt values, it does not natively support automatic rotation of secrets; implementing rotation would require additional infrastructure and maintenance, increasing operational overhead. Option C is incorrect because storing credentials in Lambda environment variables is less secure than using a dedicated secret manager, and writing a custom function for rotation adds significant development and maintenance burden. Option D is incorrect because AWS KMS is designed for encryption key management, not for storing application secrets like database usernames and passwords, nor does it offer direct credential rotation features.

Community Comment Notes

Community consensus strongly supports Option B. As LeonSauveterre noted, "Parameter Store doesn't support automatic rotation," highlighting the critical differentiator. Another commenter emphasized avoiding custom code: "Don't write a custom function when you can use off-the-rack ones." The general agreement is that Secrets Manager is the standard service for this specific use case due to its managed rotation feature.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always look for keywords like 'least operational overhead' and 'automatic rotation'. If automatic rotation is required, AWS Secrets Manager is almost always the superior choice over Parameter Store unless cost is the absolute primary constraint and rotation can be handled manually.

Frequently Asked Questions

Why can't I use Parameter Store for automatic rotation?

Parameter Store does not have a native, built-in mechanism for automatically rotating secrets. You would need to build and maintain custom Lambda functions or scripts to handle rotation, which increases operational overhead significantly compared to Secrets Manager.

Is KMS suitable for storing database passwords?

No. AWS KMS is designed for managing encryption keys used to encrypt data. It is not intended for storing application secrets like database usernames and passwords, nor does it provide functionality for rotating those credentials.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. [Removed] 👍 4 Answered B
    Secrets Manager: AWS Secrets Manager is specifically designed to store and manage sensitive information like database credentials. It provides built-in functionality for securely storing, retrieving, and automatically rotating credentials. Automatic Rotation: Secrets Manager can be configured to automatically rotate the database credentials at regular intervals (e.g., every 30 days). This reduces operational overhead by eliminating the need for manual credential rotation or custom rotation logic. Integration with Lambda: Lambda functions can easily retrieve credentials stored in Secrets Manager by calling the Secrets Manager API, which simplifies the application code and enhances security.
  2. LeonSauveterre 👍 2 Answered B
    A - Parameter Store doesn't support automatic rotation. C - Don't write a custom function when you can use off-the-rack ones. D - AWS KMS is a service for managing encryption keys, not for managing secrets like database credentials. Also it doesn't provide direct support for managing or rotating database credentials.
  3. aragon_saa 👍 1 Answered B
    Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide