How to Rotate RDS Administrator Passwords Annually and Most Efficiently?

Why the Answer Is Correct

AWS Secrets Manager was purpose-built to store and rotate database credentials, and it ships with a native rotation capability specifically for Amazon RDS (including the master user password). Enabling rotation with a 365-day schedule satisfies the compliance requirement with no custom code, no database triggers, and no self-maintained Lambda functions. Secrets Manager also updates the password in both the secret and the RDS instance atomically, so applications reading the secret keep working. That combination of managed rotation plus zero operational overhead is exactly what "MOST operationally efficient" points to.

Why the Other Options Are Wrong

Option B puts credentials in an RDS parameter group, which is a configuration container for engine parameters — credentials do not belong there and a database trigger cannot rotate the RDS master password it is authenticating with. Option C stores secrets in a private S3 bucket and uses a scheduled Lambda to generate new credentials, which means you own the code, the error handling, the RDS password change call, and the retry logic — far less efficient than a managed rotation function. Option D looks strong because Parameter Store SecureString encrypts values with KMS, but Parameter Store offers no native RDS rotation; you would have to write and maintain the rotation Lambda yourself, so it is not the most operationally efficient solution.

Community Comment Notes

As Bad_Mat noted, Secrets Manager provides "built-in, native support to manage and automatically rotate credentials for Amazon RDS", which removes the need for custom scripts, database triggers, or scheduled functions. That framing mirrors the exam's efficiency language: the deciding factor is not whether a store is encrypted, but whether rotation is a managed, turnkey feature. Community consensus on this question lines up behind the Secrets Manager option for that reason.

Operational Considerations

A 365-day rotation schedule is the minimum the compliance team accepts; Secrets Manager also supports shorter schedules and multi-user rotation strategies if the team tightens the policy later. The rotation Lambda that Secrets Manager invokes can reach the database through a VPC, so ensure the rotation function has network access to the RDS instance before you enable the schedule.