Q71 — AWS SAA-C03 Ch.12

Question 71 of 100 | ← Chapter 12

Q871. A company uses Amazon RDS for PostgreSQL databases for its data tier. The company must implement password rotation for the databases.Which solution meets this requirement with the LEAST operational overhead?

Correct Answer: A. Store the password in AWS Secrets Manager. Enable automatic rotation on the secret.

Explanation

To implement password rotation for Amazon RDS PostgreSQL databases with the least operational overhead, the recommended solution is:A. Store the password in AWS Secrets Manager and enable automatic rotation on the secret.Here's why:AWS Secrets Manager is a fully managed service that helps you protect secrets such as database credentials, API keys, and other sensitive information. It integrates seamlessly with Amazon RDS and provides built-in support for automatic rotation of secrets.By storing the password in AWS Secrets Manager and enabling automatic rotation on the secret, the password for the Amazon RDS PostgreSQL databases will be automatically rotated according to the configured rotation schedule. This eliminates the need for manual intervention and reduces operational overhead.Option B suggests storing the password in AWS Systems Manager Parameter Store and enabling automatic rotation on the parameter. While AWS Systems Manager Parameter Store can store sensitive information, it doesn't provide built-in support for automatic rotation. Implementing password rotation would require custom scripting or manual intervention, leading to increased operational overhead.Option C suggests storing the password in AWS Systems Manager Parameter Store and writing an AWS Lambda function to rotate the password. While this approach allows for custom rotation logic, it introduces additional complexity and requires ongoing management and monitoring of the Lambda function.Option D suggests storing the password in AWS Key Management Service (AWS KMS) and enabling automatic rotation on the AWS KMS key. While AWS KMS provides key management capabilities, it is not specifically designed for password rotation. Implementing password rotation using AWS KMS would require custom scripting or manual intervention, resulting in increased operational overhead.In summary, the recommended solution is to store the password in AWS Secrets Manager (Option A) and enable automatic rotation on the secret. This provides a seamless and fully managed solution for password rotation with minimal operational overhead.