Q43 — AWS SAA-C03 Ch.17

Question 43 of 89 | ← Chapter 17

Q1343. A company's solutions architect is building a static website to be deployed in Amazon S3 for a production environment. The website integrates with an Amazon Aurora PostgreSQL database by using an AWS Lambda function. The website that is deployed to production will use a Lambda alias that points to a specific version of the Lambda function.The company must rotate the database credentials every 2 weeks. Lambda functions that the company deployed previously must be able to use the most recent credentials.Which solution will meet these requirements?

Correct Answer: A. Store the database credentials in AWS Secrets Manager. Turn on rotation. Write code in the Lambda function to retrieve the credentials from Secrets Manager.

Explanation

Let me analyze this Lambda and database credentials rotation scenario.**Requirements:**\1. Static website on S3 with Lambda function integrating with Aurora PostgreSQL \2. Lambda uses an alias pointing to a specific version\3. Database credentials must be rotated every 2 weeks\4. Previously deployed Lambda functions must be able to use the most recent credentials \5. Production environment**Key constraint:** Lambda alias points to a specific version. This means updating environment variables or code requires deploying a new version and updating the alias. But the requirement says "previously deployed Lambda functions must be able to use the most recent credentials" - this suggests older versions should still work with new credentials.Wait, let me re-read: "Lambda functions that the company deployed previously must be able to use the most recent credentials."This means if there's an old version of the Lambda function still running (or being invoked), it should be able to retrieve the current credentials, not the credentials that existed when it was deployed.**Analyzing each option:****Option A:**- Store credentials in AWS Secrets Manager- Turn on automatic rotation (can be set to 2 weeks)- Lambda retrieves credentials from Secrets Manager at runtime- **Analysis:**- Secrets Manager supports automatic rotation- Lambda retrieves credentials at runtime, so every invocation gets current credentials- Even old Lambda versions will get new credentials because they fetch them fresh each time- This meets all requirements**Option B:**- Include credentials in Lambda function code- Update periodically and deploy new function- **Analysis:**- Requires redeployment every 2 weeks- Old versions of the function (pointed to by alias or otherwise) will have old credentials hardcoded- Violates requirement that previously deployed functions must use most recent credentials- Security anti-pattern- **Fails****Option C:**- Use Lambda environment variables- Update when new credentials available- **Analysis:**- To update environment variables, you must publish a new Lambda version- The alias points to a specific version, so it won't see the updated environment variables until you update the alias to point to the new version- Old versions (even if still accessible) will have old credentials in their environment variables- Violates requirement that previously deployed functions must use most recent credentials- **Fails****Option D:**- Store credentials in Systems Manager Parameter Store- Turn on rotation- Lambda retrieves from Parameter Store- **Analysis:**- Parameter Store can store credentials- However, Parameter Store doesn't have native automatic rotation like Secrets Manager- You can configure rotation, but it's more complex and typically requires Secrets Manager integration or custom solutions- Secrets Manager is purpose-built for secrets rotation- While this could work, it's not the best solution because Parameter Store's rotation capabilities are limited compared to Secrets Manager**Comparison of A vs D:**Both A and D allow runtime retrieval of credentials, which means old Lambda versions get new credentials.However:- Secrets Manager (A) has native, built-in rotation support with built-in Lambda rotation functions- Parameter Store (D) doesn't have automatic rotation; you'd need to implement it yourself or use Secrets Manager behind the scenes- Secrets Manager is specifically designed for database credentials rotation- Secrets Manager also provides features like automatic password generation and seamless rotation**Conclusion:**The answer is **A** - AWS Secrets Manager with rotation enabled is the standard, purpose-built solution for database credential rotation that works with Lambda without requiring redeployment.**Answer: A** The answer is **A**.## Analysis**Key requirements:**- Credentials rotated every 2 weeks automatically- Previously deployed Lambda functions must use **current** credentials (not the credentials from when they were deployed)- Lambda alias points to specific function version (immutable once published)**Critical insight:** Since Lambda versions are immutable, embedding credentials in code (B) or environment variables (C) means old versions retain old credentials forever. The solution must retrieve credentials **at runtime** from an external source.**Option evaluation:**| Option | Storage Location | Rotation Support | Runtime Retrieval | Old Function Versions | Verdict | |——--|————-----|——————|——————-|——————----|——---| | **A** | Secrets Manager | Native automatic | Yes | Get current credentials | **Correct** | | **B** | Hardcoded in code | Manual redeploy | No | Stuck with old credentials | | | **C** | Environment variables | Manual update | No (immutable per version) | Stuck with old credentials | || **D** | Parameter Store | Limited/custom | Yes | Get current credentials | Suboptimal |## Why Option A is Best**AWS Secrets Manager** is purpose-built for this use case:\1. **Native rotation**: Built-in automated rotation every 2 weeks using Lambda rotation functions \2. **Runtime retrieval**: Functions call `GetSecretValue` API during execution, always receiving current credentials\3. **Version immunity**: Even old Lambda versions (pointed to by existing aliases) fetch fresh credentials on each invocation\4. **Aurora integration**: Native support for PostgreSQL credential rotation**Option D distinction:** While Parameter Store can store secrets, it lacks native automatic rotation. You'd need to build custom rotation logic or integrate with Secrets Manager anyway, making A the direct solution.**Answer: A**