Q58 — AWS SAA-C03 Ch.11

Question 58 of 100 | ← Chapter 11

Q758. A company runs its databases on Amazon RDS for PostgreSQL. The company wants a secure solution to manage the master user password by rotating the password every 30 days.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: C. Integrate AWS Secrets Manager with Amazon RDS for PostgreSQL to automate password rotation.

Explanation

To meet the requirement of securely managing the master user password for Amazon RDS for PostgreSQL and rotating the password every 30 days with the least operational overhead, the most suitable solution is:C. Integrate AWS Secrets Manager with Amazon RDS for PostgreSQL to automate password rotation.Option C provides the desired functionality with minimal operational overhead:Integrate AWS Secrets Manager with Amazon RDS for PostgreSQL to automate password rotation:AWS Secrets Manager is a service that helps you protect access to applications, services, and IT resources. It provides a secure and scalable solution for managing secrets such as database credentials. By integrating AWS Secrets Manager with Amazon RDS for PostgreSQL, you can automate the rotation of the master user password. AWS Secrets Manager can generate and store a new password, update the password in Amazon RDS, and ensure that applications have access to the updated password without manual intervention. This approach eliminates the need for manual password rotation and reduces operational overhead.Here's why option C is the best choice:\1. Automated password rotation: AWS Secrets Manager provides built-in functionality for automating the rotation of secrets, including database credentials. By configuring a rotation schedule, you can ensure that the master user password for Amazon RDS is automatically rotated every 30 days, as required.\2. Integration with Amazon RDS: AWS Secrets Manager integrates seamlessly with Amazon RDS for PostgreSQL. It can retrieve the current password from Amazon RDS, generate a new password, and update the password in Amazon RDS without manual intervention. This ensures a secure and reliable password rotation process.Options A, B, and D are not the most suitable choices in this scenario:Option A suggests using Amazon EventBridge to schedule a custom AWS Lambda function to rotate the password every 30 days. While it is possible to implement a custom solution using Lambda and EventBridge, it would require more operational overhead compared to the built-in functionality provided by AWS Secrets Manager.Option B suggests using the modify-db-instance command in the AWS CLI to change the password. While this approach allows for manual password rotation, it does not provide automated rotation every 30 days as required. Manual rotation is more error-prone and introduces additional operational overhead.Option D suggests integrating AWS Systems Manager Parameter Store with Amazon RDS for PostgreSQL to automate password rotation. While AWS Systems Manager Parameter Store can store and manage secrets, it does not provide native support for automating password rotation for Amazon RDS. Implementing password rotation with Parameter Store would require developing custom solutions, increasing operational complexity.Therefore, the most appropriate solution to securely manage the master user password for Amazon RDS for PostgreSQL and rotate the password every 30 days with minimal operational overhead is C: Integrate AWS Secrets Manager with Amazon RDS for PostgreSQL to automate password rotation.