SAA-C03 Q493 · Security

Question

A company has an application that runs on Amazon EC2 instances in an Auto Scaling group. The application uses hardcoded credentials to access an Amazon RDS database. To comply with new regulations, the company needs to automatically rotate the database password for the application service account every 90 days. Which solution will meet these requirements?

Accepted Answer

**Option B** is correct because it addresses every requirement cleanly:

1. **Eliminate hardcoded credentials**: By storing the database password in AWS Secrets Manager, the application no longer needs hardcoded credentials. Instead, it makes an API call (`GetSecretValue`) to retrieve the current password at runtime.

2. **Automatic rotation every 90 days**: Secrets Manager has **built-in rotation support** for Amazon RDS databases. When you enable rotation, Secrets Manager automatically provisions a Lambda function (using AWS-provided templates) that handles the password change in both Secrets Manager and the RDS database simultaneously. You simply configure the rotation interval to 90 days.

3. **No manual intervention**: The rotation is fully automated — Secrets Manager triggers the Lam

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips