CLF-C02 Practice Question 45: Credential Rotation

AWS Secrets Manager stores secrets such as database credentials and can rotate them automatically on a schedule. Rotation updates the credentials in both places, the secret and the database, so the two always match. The application stops hard-coding the password and fetches the current value from Secrets Manager when it connects, so no code change is needed when the password changes. For many AWS-managed secrets, the service configures the rotation itself.

Option A, AWS KMS, creates and manages the *encryption keys* used to protect data (Secrets Manager uses KMS to encrypt the secrets it stores). It does not store application passwords or rotate database credentials. Option C, ACM, provisions and renews SSL/TLS *certificates* for services such as load balancers. It does not handle database passwords. Option D, IAM Identity Center, gives a company's workforce single sign-on to AWS accounts and applications. It does not manage the credentials an application uses to connect to a database.

Reference: Rotate AWS Secrets Manager secrets