Q50 — AWS SAA-C03 Ch.16

Question 50 of 100 | ← Chapter 16

Q1250. A company needs to securely store credentials that an application that runs on an Amazon EC2 instance uses to access an Amazon RDS DB instance. The company must rotate the credentials every 3 months Which solution will meet these requirements with LEAST operational overhead?

• A. Store the credentials in an AWS Systems Manager Parameter Store parameter. Use an AWS KMS key to encrypt the parameter. Create an lAM role that has read access to the parameter. Configure a 3- month rotation schedule for theparameter. Allow the lAM role decrypt access to the KMS key.Assign the lAM role to the EC2 instance.
• B. Store the credentials in an AWS Systems Manager Parameter Store parameter. Use an AWS KMS key to encrypt the parameter. Create an IAM policy that allows read access to the parameter. Configure a 3- month rotation schedule for the parameter. Add decrypt permissions for the KMS key to the lAM policy.Assign the lAM policy to the EC2 instance.
• C. Store the database credentials in an AWS Secrets Manager secret. Configure a 3-month rotation schedule for the secret. Create an IAM role that has permissions to access the secret. Assign the IAM role to the EC2 instance. ✓
• D. Store the database credentials in an AWS Systems Manager Parameter Store parameter. Use an AWS Lambda function to rotate the credentials every 3 months. Create an lAM role that has permissions to access the parameter. Assign the lAM role to the EC2 instance

Correct Answer: C. Store the database credentials in an AWS Secrets Manager secret. Configure a 3-month rotation schedule for the secret. Create an IAM role that has permissions to access the secret. Assign the IAM role to the EC2 instance.

Explanation

The correct answer is C. Here's the breakdown:Option C (Correct)AWS Secrets Manager is specifically designed for securely storing and rotating credentials (e.g., database passwords).It automatically handles rotation (including for Amazon RDS) with built-in Lambda functions or custom rotation logic.The IAM role assigned to the EC2 instance only needs permissions to retrieve the secret, reducing operational overhead.No manual encryption/decryption is required--Secrets Manager handles this via AWS KMS. Least operational overhead because rotation is fully managed by AWS.Why the Other Options Are Less OptimalOption A & B (Parameter Store)While Parameter Store can store secrets, it does not natively support automatic rotation (unlike Secrets Manager).Rotation would require custom automation (e.g., Lambda), increasing complexity. In Option B, assigning an IAM policy directly to the EC2 instance (instead of using a role) is less secure and not a best practice.Option D (Parameter Store + Lambda Rotation)Requires manual setup of a Lambda function for rotation, increasing operational overhead. Secrets Manager already provides this functionality out of the box.ConclusionAWS Secrets Manager (Option C) is the best choice because it:Automatically rotates credentials every 3 months.Integrates seamlessly with RDS.Requires minimal setup (IAM role + secret configuration).Reduces operational overhead compared to Parameter Store-based solutions.答案:C