A retailer order service connects to an Amazon RDS for MySQL database, using credentials stored in AWS Secrets Manager. The security team must rotate the database password every 30 days without downtime, because the service handles checkout around the clock.
The team wants each rotation to create a fresh password while the old one still works, so that instances that have not yet refreshed their connection keep working. The rotation should need no manual steps each month.
Which solution meets these requirements?
Choose one answer.
AA. Use the managed alternating-users rotation strategy on a 30-day schedule. Each rotation updates the user that is not in use, so the other user's password keeps working.
BB. Use the single-user rotation template on a 30-day schedule. The rotation changes the one database user password in place, and the application reads the new value from Secrets Manager on its next call.
CC. Turn off rotation, and have an engineer change the database password by hand every quarter. Update the secret with the new value, and then restart the order service instances to pick it up.
DD. Run a cron job on an EC2 instance that holds the database admin password in its environment. The job changes the password every 30 days, writes it to Secrets Manager, and keeps old passwords in a file for rollback.
Show the answer and explanation
Answer: A
A. Right: Correct. Alternating users keep two valid credentials, and each rotation updates the idle user before the application switches to it, so connections do not break. The schedule runs every rotation without manual steps. Learn more: Rotating secrets in AWS Secrets Manager (opens in a new tab)
B. Wrong: Single-user rotation changes the only password in place, so connections that still use the old value fail until they refresh. The checkout service cannot tolerate that gap, so this option breaks the no-downtime requirement.
C. Wrong: Manual changes need a restart and an outage window, and a quarterly schedule misses the 30-day period. This option fails both the schedule and the no-downtime requirement.
D. Wrong: The job would work, but it keeps an admin credential on a server and in environment variables, and it adds a system to maintain. Secrets Manager rotation already provides the schedule and the change without that exposure.
Explanation
Secrets Manager rotation runs on a schedule, and the alternating-users strategy keeps two valid credentials so the active one never disappears during a change. Single-user rotation and manual changes cause gaps or outages, and a self-run script exposes admin credentials. The alternating-users approach meets the schedule and the no-downtime rule together.
Want more on Secrets and credential rotation (Secrets Manager)? The 5 full-length practice sets have 5 more Secrets and credential rotation (Secrets Manager) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →