SAA-C03 Practice Question 72: RDS IAM Database Authentication

IAM database authentication works with MariaDB, MySQL and PostgreSQL, so the engine stays where it is. With it enabled, the application does not use a password: it asks RDS to generate an authentication token, signed with Signature Version 4, and presents that token in place of one. Each token is valid for 15 minutes, no credential is stored on the instance or in configuration, and access is controlled by IAM policies rather than per-instance database grants. AWS also lists encryption of traffic with SSL/TLS as a property of this authentication method, and for applications on EC2 it explicitly recommends using the instance's own profile credentials to obtain the token.

Option A is a genuine improvement over a file on disk, and it is the right answer when the engine or driver cannot do better. It still leaves a long-lived database password that exists, must be rotated, and can be read by anything with permission to the parameter, which is what security asked to eliminate.

Option B solves connection pooling and failover, not credential storage. RDS Proxy retrieves the database credentials from Secrets Manager, so a stored password still exists; the proxy simply moves who reads it.

Option C is the weakest of the four. User data is visible from instance metadata and in the launch template, so the password ends up in more places than it started, not fewer.

Reference: IAM database authentication for MariaDB, MySQL, and PostgreSQL