CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate Exam Question Walkthrough: Database Credential Rotation
Learn how to tackle AWS SAA-C03 questions about automatic credential rotation. We break down the options and clarify the concept.
An application requires automatic rotation of database credentials every 30 days. This requirement often trips up candidates during the exam. Many services can store credentials, but only one is built for automatic rotation.
The question
An application stores database credentials that must be rotated automatically every 30 days without code changes. Which service is designed for this?
- A. AWS Systems Manager Parameter Store (String type)
- B. AWS Secrets Manager
- C. Amazon S3 with encryption
- D. Environment variables baked into the AMI
Think before you scroll
Before choosing an answer, consider the specific requirement: automatic rotation every 30 days. Many services can store secrets, but not all provide built-in rotation capabilities.
The answer
The correct option is B. AWS Secrets Manager. It supports automatic rotation for credentials with Lambda integration, making it the ideal choice for this requirement.
Why the other options lose
- A. AWS Systems Manager Parameter Store (String type): While it can store parameters securely, it does not natively support automatic rotation of secrets. This means it cannot fulfill the requirement for regular rotation without additional coding.
- C. Amazon S3 with encryption: S3 is a storage service, not a credential management service. Although it can store encrypted data, it lacks the automatic rotation features necessary for managing database credentials effectively.
- D. Environment variables baked into the AMI: Storing credentials in environment variables within an AMI does not provide a secure or automated way to rotate secrets. This method requires manual updates and redeployments, which contradicts the requirement for automatic rotation.
The concept behind it
The principle here is understanding the difference between secret management and general storage. Effective secret management is essential for maintaining security, especially when it comes to sensitive data like database credentials. Services like AWS Secrets Manager are specifically designed to handle these tasks effectively, including automatic rotation, which enhances security without manual intervention.
Exam trap to remember
Remember: if a question specifies automatic rotation of credentials, think AWS Secrets Manager. It’s built for that purpose, while other options may fall short.