DVA-C02 · Question #421
A company has an ecommerce web application that uses an on-premises MySQL database as a data store. The company migrates the on-premises MySQL database to Amazon RDS for MySQL. A developer needs to…
The correct answer is B. Store the MySQL credentials as secrets in AWS Secrets Manager. Create an IAM role that has. The application must access RDS for MySQL without long-term credentials. AWS Secrets Manager with automatic rotation and an IAM role for access eliminates the need to embed static database passwords.
Question
A company has an ecommerce web application that uses an on-premises MySQL database as a data store. The company migrates the on-premises MySQL database to Amazon RDS for MySQL. A developer needs to configure the application's access to the RDS for MySQL database. The developer's solution must not use long term credentials. Which solution will meet these requirements?
Options
- AEnable IAM database authentication on the RDS for MySQL DB instance. Create an IAM role that
- BStore the MySQL credentials as secrets in AWS Secrets Manager. Create an IAM role that has
- CConfigure the MySQL credentials as environment variables that are available at runtime for the
- DStore the MySQL credentials as SecureString parameters in AWS Systems Manager Parameter
How the community answered
(50 responses)- A12% (6)
- B78% (39)
- C6% (3)
- D4% (2)
Why each option
The application must access RDS for MySQL without long-term credentials. AWS Secrets Manager with automatic rotation and an IAM role for access eliminates the need to embed static database passwords.
Although IAM database authentication avoids passwords, the truncated option A likely includes a configuration detail (such as storing static credentials or missing rotation) that disqualifies it from fully meeting the requirement.
AWS Secrets Manager stores the database credentials and supports automatic rotation, so the application never relies on a static, long-lived password. An IAM role grants the application permission to retrieve the secret at runtime via the Secrets Manager API, meaning no long-term credentials are hardcoded or stored in the application environment.
Storing MySQL credentials as environment variables exposes static, long-term credentials that do not rotate, violating the no long-term credentials requirement.
AWS Systems Manager Parameter Store SecureString still stores a static credential; without Secrets Manager's automatic rotation, the password remains a long-term secret.
Concept tested: RDS access using Secrets Manager without long-term credentials
Source: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html
Community Discussion
No community discussion yet for this question.