Exams / DOP-C02 / Study guide / Credential rotation for machine identities

Credential rotation for machine identities: DOP-C02 study notes and practice questions

What to know about Credential rotation for machine identities for the DOP-C02 exam, from the Security and Compliance domain (17% of the exam guide), then 1 free question to test it. Part of the DOP-C02 study guide.

Last verified October 2026 against current AWS documentation ·How we write our questions

What to know for the exam

These questions ask how to rotate database passwords, API keys and access keys automatically and safely.

Secrets Manager rotation

Managed rotation for RDS, Aurora, Redshift and DocumentDB; services like RDS can also manage the master password for you.
Lambda rotation functions (from templates or your own) for other secrets; the function needs network access to both the database and Secrets Manager.
Schedules by days or cron expressions, with a rotation window.

Strategies

Strategy	How	Trade-off
Single user	Change the password of one user	Brief window where connections with the old password fail
Alternating users	Two users; rotation updates the inactive one, then switches	No downtime; needs a superuser secret to change passwords

Staging labels

AWSCURRENT (in use), AWSPENDING (being created and tested) and AWSPREVIOUS (the last one).
Rotation steps: createSecret → setSecret → testSecret → finishSecret, which moves AWSCURRENT.
Apps should cache secrets briefly and re-fetch on authentication failure.

Resource policies share secrets across accounts; the KMS key must be a customer managed key with a policy that allows the other account.
Replicate secrets to other Regions for DR.
Config rules and Security Hub CSPM flag secrets that aren’t rotated.

Removing static credentials

Prefer IAM roles (instance profiles, task roles, OIDC federation) so there’s nothing to rotate.
For unavoidable IAM access keys, rotate by creating a second key, updating the app, then deactivating and deleting the old key; Access Analyzer and credential reports find old keys.

Common traps

Parameter Store when the ask is built-in rotation.
Single-user rotation when zero failed connections are required.
A rotation Lambda without a route to Secrets Manager from its VPC.

Side by side: Secrets Manager vs Parameter Store

Try the 1 practice question

Practice Credential rotation for machine identities Take the free practice exam

Question 1

Medium ·Link to this question

A SaaS startup runs its API on Amazon ECS. The API connects to a PostgreSQL database that runs on a self-managed EC2 instance, not on Amazon RDS, and the database password is stored in AWS Secrets Manager.

The security policy requires the password to rotate every 30 days, and the API must keep serving requests during each rotation without a restart outage. Each task reads the secret when it starts and then keeps its connection pool open.

The team wants a rotation that it can test before turning it on for production.

Which approach meets these requirements?

Choose one answer.

A. Use a rotation function that changes the single database user's password in place in one step, then updates the secret, so the rotation is as short as possible.
B. Rotate the password by hand each month, and have an engineer update the secret and restart the ECS service during a quiet period.
C. Turn on rotation with a Lambda function that uses the alternating-users strategy and a superuser secret, testing the new user before AWSCURRENT moves.
D. Store the password in an SSM Parameter Store SecureString instead, and rely on the parameter's expiration policy to remind the team to change it every 30 days.

Show the answer and explanation

Answer: C

A. Wrong: Changing a single user's password in place breaks existing connections and any task that reads the old secret before the update finishes. The API would see failed connections during each rotation.
B. Wrong: A manual rotation needs a person every month and a restart, so the policy and the no-outage requirement are both at risk. It also does not give the team a tested rotation. Learn more: Rotate AWS Secrets Manager secrets (opens in a new tab)
C. Right: Correct. With two users, the previous credentials stay valid while tasks still hold the old secret, and the rotation tests the new credentials before the AWSCURRENT label moves. A superuser secret lets the function create the cloned user. Learn more: Lambda function rotation strategies (opens in a new tab)
D. Wrong: A parameter expiration policy notifies only; it does not change the password or update the database. The team would still do the rotation by hand. Learn more: Assigning parameter policies in Parameter Store (opens in a new tab)

Explanation

A rotation with two database users, using the Secrets Manager staging labels, lets the new credential be created and tested while the old one still works. The switch happens by moving AWSCURRENT, and tasks that still hold the old secret keep working until they restart. Single-user in-place rotation, manual changes and parameter expiration each cause outages or leave the work to people.

Study

Want more on Credential rotation for machine identities? The 5 full-length practice sets have 9 more Credential rotation for machine identities questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Credential rotation for machine identities

Rotate AWS Secrets Manager secrets