A clothing company uses a custom ecommerce application and a PostgreSQL database to sell clothes to thousands of users from multiple countries. The company is migrating its application and database…

Question

Options

• AStore the credentials in a text file in an Amazon S3 bucket. Restrict permissions on the bucket to
• BConfigure IAM database authentication for the application to connect to the database. Create an
• CStore the credentials in AWS Secrets Manager. Restrict permissions on the secret to only the IAM
• DStore the credentials in an encrypted text file in the application AMI. Use AWS KMS to store the

• A
  3% (2)
• B
  9% (6)
• C
  84% (57)
• D
  4% (3)

Explanation

Explanation

AWS Secrets Manager (Option C) is purpose-built for securely storing, rotating, and managing database credentials, and it natively supports automatic rotation on a defined schedule (such as every 60 days) for Amazon RDS databases - directly satisfying the requirement. By restricting IAM permissions on the secret, only authorized roles (like the EC2 application role) can retrieve the credentials, following the principle of least privilege.

Option A is wrong because storing credentials in a plain text file in S3 - even with restricted permissions - is not a secure secrets management practice and lacks automatic rotation capabilities.

Option B is wrong because while IAM database authentication is a valid security feature for RDS, it uses IAM tokens instead of traditional passwords, meaning it doesn't actually address password rotation - it essentially bypasses the password requirement rather than managing it.

Option D is wrong because baking credentials into an AMI (even encrypted) is a poor security practice; rotating credentials every 60 days would require rebuilding and redeploying the AMI, making it operationally impractical and insecure.

Memory Tip: Think "Secrets Manager = Secrets + Rotation Manager." Whenever an exam question mentions secure credential management + automatic rotation, AWS Secrets Manager is almost always the answer.

No community discussion yet for this question.