SAA-C03 Q399 · Security

Question

A company is designing a secure solution to grant access to its Amazon RDS for PostgreSQL database. Applications that run on Amazon EC2 instances must be able to securely authenticate to the database without storing long-term credentials. Which solution will meet these requirements?

Accepted Answer

**Answer D** meets every requirement:

1. **No long-term credentials stored**: IAM roles attached to EC2 instances provide temporary credentials automatically via the instance metadata service. No passwords, access keys, or secrets are stored anywhere on the instance.

2. **Secure authentication to RDS**: RDS IAM database authentication works by generating a short-lived **authentication token** (valid for 15 minutes) using the IAM role's temporary credentials. The application calls `rds.generate-db-auth-token()` which produces a token signed by AWS STS.

3. **How the flow works**:
   - EC2 instance has an IAM role with a policy allowing `rds-db:connect` action
   - Application uses the IAM role's temporary credentials to call the RDS API and generate an authentication token
   - Applicatio

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips