SAA-C03 Practice Question 2: Secrets Manager Rotation
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 1 · question 2 of 10
A reporting application on EC2 reads its Amazon RDS for MySQL username and password from a plaintext file baked into the AMI. An audit requires that the database password be rotated automatically every 30 days and that it never be stored in an image or a source repository. The team has been told not to write or maintain any custom rotation code.
The application is being updated so that it retrieves the credentials through an AWS API call each time it opens a connection. Which approach meets the requirements?
Show answer and explanation
Answer:
Secrets Manager is the only one of these services that rotates a secret and changes the password on the database at the same time. For supported engines, including RDS for MySQL, you attach the secret to the DB instance and enable managed rotation: AWS runs the rotation on the schedule you set, updates the credential in RDS, and stages the new value under the AWSCURRENT label so callers of GetSecretValue transparently pick it up. No rotation code is written or maintained by the team, and the secret never lands in an AMI or a repo.
Option A gets the encryption right but not the rotation. Parameter Store SecureString parameters are encrypted with KMS, but Parameter Store has no built-in rotation mechanism and no integration that would reset the password on the RDS side; you would have to build and own that yourself, which the stem rules out.
Option C is a misreading of what S3 Lifecycle does. Lifecycle rules transition objects between storage classes or expire them; they cannot generate a new password, write it into an object, or tell RDS about it. The credential would sit unchanged (or simply be deleted) while the database password stayed the same forever.
Option D would functionally work, but it is precisely the custom rotation code the requirements forbid: the team ends up owning the Lambda function, its RDS permissions, its error handling, and the race between updating the table and updating the database.
Reference: Rotate AWS Secrets Manager secrets