Least-Overhead Password Rotation for Amazon RDS for PostgreSQL?

Why the Answer Is Correct

AWS Secrets Manager is purpose-built for storing and rotating secrets, and it ships with managed rotation Lambda functions for Amazon RDS (including PostgreSQL and Aurora) that change the database password and update the secret in one step. Because rotation is a configuration toggle — a schedule plus the secret and database — rather than code you own, option A satisfies the "LEAST operational overhead" clause in the question. As Scheldon notes, quoting the AWS documentation, "In Secrets Manager, you can set up automatic rotation for your secrets." jcck202020 makes the same point: the option wins because it "leverages built-in features specifically designed for managing and rotating database credentials securely." Nothing else in the list provides rotation of the credential itself as a managed feature.

Why the Other Options Are Wrong

Option B fails because AWS Systems Manager Parameter Store is a configuration and secret storage service — it can hold a SecureString password, but it has no automatic rotation capability at all, so enabling "rotation on the parameter" is not a real feature. Option C is technically possible but contradicts the requirement: you would write, deploy, test and maintain an AWS Lambda rotator function, plus its IAM role, schedule and failure handling, which is the definition of high operational overhead. Option D confuses two different kinds of rotation: AWS KMS automatic key rotation generates new backing key material for a customer managed key, and it never changes the password that the application uses to authenticate to PostgreSQL. The database credential would remain static and still have to be rotated manually.

Community Comment Notes

All of the recorded votes on this item point to A, and the comments are consistent rather than merely numeric agreement. Scheldon anchors the reasoning in the official Secrets Manager rotation documentation, and 88f8032 simply records "A. AWS Secrets Manager" as the pick. jcck202020 adds the clearest explanation of the deciding keyword, framing A as the option that meets the requirement "with the least operational overhead" by relying on built-in features. No commenter defends Parameter Store or KMS as a rotator, which is a useful signal that the distractors are weak rather than debatable.