Q6 — AWS SAA-C03 Ch.17

Question 6 of 89 | ← Chapter 17

Q1306. A company has workloads that run on AWS. Each workload has a separate Amazon RDS database. A security audit finds that the company does not meet a requirement to rotate the RDS master user credentials every 30 days. Each RDS DB instance must also have a different set of credentials that are accessible only by the relevant application layer and by the team that supports the workload. Which solution will meet these requirements with the LEAST operational overhead?

• A. Use AWS Secrets Manager to set up RDS password management. Use a combination of IAM policies and RDS policies to restrict access to the credentials.
• B. Use AWS Secrets Manager to set up RDS password management. Use a combination of IAM policies and Secrets Manager policies to restrict access to the credentials. ✓
• C. Create an Amazon Simple Notification Service(Amazon SNS) topic for each workload. Create a scheduled AWS Lambda function that rotates the RDS master user credentials every 30 days.Configure the Lambda function to publish the new credentials to the SNS topic for each application and team.
• D. Create an Amazon S3 bucket that uses AWS Key Management Service(AWS KMS) for encryption.Create a scheduled AWS Lambda function that rotates the RDS master user credentials every 30 days. Configure the Lambda function to push the new credentials to the S3 bucket. Use KMS key policies to restrict access to the credentials.

Correct Answer: B. Use AWS Secrets Manager to set up RDS password management. Use a combination of IAM policies and Secrets Manager policies to restrict access to the credentials.

Explanation

Let me analyze each option against the requirements:Requirements:\1. Rotate RDS master user credentials every 30 days\2. Different credentials for each RDS instance\3. Access restricted to relevant application layer and support team \4. LEAST operational overheadAnalysis of Options:A. Use AWS Secrets Manager to set up RDS password management. Use a combination of IAM policies and RDS policies to restrict access to the credentials.Rotation: Secrets Manager supports automatic RDS credential rotation Access control: IAM policies work, but RDS policies are not the primary way to restrict credential access (Secrets Manager policies are more appropriate)B. Use AWS Secrets Manager to set up RDS password management. Use a combination of IAM policies and Secrets Manager policies to restrict access to the credentials. Rotation: Secrets Manager supports automatic RDS credential rotation Access control: IAM + Secrets Manager policies are the correct and most granular way to control access Operational overhead: Fully managed service with automatic rotation - minimal overheadC. Create an Amazon Simple Notification Service(Amazon SNS) topic for each workload. Create a scheduled AWS Lambda function that rotates the RDS master user credentials every 30 days. Configure the Lambda function to publish the new credentials to the SNS topic for each application and team. Rotation: Custom Lambda function requires manual implementation and maintenance Security: Publishing credentials to SNS is not secure (no encryption at rest, broad access) Operational overhead: High - need to maintain Lambda code, handle failures, secure SNSD. Create an Amazon S3 bucket that uses AWS Key Management Service(AWS KMS) for encryption. Create a scheduled AWS Lambda function that rotates the RDS master user credentials every 30 days. Configure the Lambda function to push the new credentials to the S3 bucket. Use KMS key policies to restrict access to the credentials.Rotation: Custom Lambda function requires manual implementation and maintenance Security: S3 is not designed for credential storage (even with KMS) Operational overhead: High - need to maintain Lambda code, handle S3 access, manage KMS policiesConclusion:Option B is the best solution because:- AWS Secrets Manager is specifically designed for credential management- It provides built-in, automated rotation for RDS credentials- IAM and Secrets Manager policies provide fine-grained access control- It requires the least operational overhead (fully managed)The final answer is [\boxed{B}]