A company uses Amazon RDS for PostgreSQL databases for its data tier. The company must implement password rotation for the databases. Which solution meets this requirement with the LEAST operational o

The correct answer is A. Store the password in AWS Secrets Manager. Enable automatic rotation on the secret.. AWS Secrets Manager is the recommended service for managing and automatically rotating database credentials. It integrates natively with Amazon RDS (including PostgreSQL), supports built-in rotation functionality, and requires minimal setup. Secrets Manager also supports versioni

Submitted by weili_xi· Mar 4, 2026Design Secure Architectures

Question

A company uses Amazon RDS for PostgreSQL databases for its data tier. The company must implement password rotation for the databases. Which solution meets this requirement with the LEAST operational overhead?

Options

AStore the password in AWS Secrets Manager. Enable automatic rotation on the secret.
BStore the password in AWS Systems Manager Parameter Store. Enable automatic rotation on the
CStore the password in AWS Systems Manager Parameter Store. Write an AWS Lambda function
DStore the password in AWS Key Management Service (AWS KMS). Enable automatic rotation on

How the community answered

(21 responses)

A
90% (19)
C
5% (1)
D
5% (1)

Explanation

AWS Secrets Manager is the recommended service for managing and automatically rotating database credentials. It integrates natively with Amazon RDS (including PostgreSQL), supports built-in rotation functionality, and requires minimal setup. Secrets Manager also supports versioning and auditing, which enhances operational excellence and security. Parameter Store does not natively support credential rotation. AWS KMS manages key encryption - not application secrets - so it is not applicable here.

Community Discussion

No community discussion yet for this question.

Full SAA-C03 Practice