SAA-C03 practice question: Secrets management (1 of 2)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company's order service runs on Amazon EC2 and connects to an Amazon RDS for MySQL database as a dedicated application user. The password is hard-coded in the application.
An audit now requires the password to be stored encrypted, changed automatically every 30 days, and never left out of date in the application after a change.
The team wants to write as little custom code as possible.
Which solution meets these requirements?
Choose one answer.
AA. Store the password as a Parameter Store SecureString, and have a scheduled Lambda function change it in the database every 30 days.
BB. Store the password as an advanced-tier SecureString parameter in Parameter Store, with a parameter policy that sets an expiration after 30 days.
CC. Store the password in Secrets Manager, rotate it every 30 days with the AWS-provided MySQL rotation function, and read the secret when connecting.
DD. Store the password in Secrets Manager with 30-day rotation turned on, and have the release pipeline copy the value into the application's config file.
Show the answer and explanation
Answer: C
A. Wrong: SecureString parameters are encrypted with AWS KMS, so storage is covered. Parameter Store has no built-in rotation, though, so the team would have to write, test and maintain the function that changes the password in MySQL and in the parameter. Secrets Manager supplies that rotation logic. Learn more: Assigning parameter policies in Parameter Store (opens in a new tab)
B. Wrong: Parameter policies do not change values. An Expiration policy deletes the parameter at the set time, and the notification policies only send EventBridge events. The password in the database would never change, and the application would lose its copy. Learn more: Assigning parameter policies in Parameter Store (opens in a new tab)
C. Right: Correct. Secrets Manager encrypts the secret and provides ready-made rotation function templates for Amazon RDS for MySQL, so no rotation code needs to be written. Because the application reads the secret when it opens connections, it always uses the current password. Learn more: AWS Secrets Manager rotation function templates (opens in a new tab)
D. Wrong: Rotation would work, but the application would keep the value from its last release. After the next rotation, the config file holds an old password and new connections fail. The application must read the secret from Secrets Manager at run time. Learn more: Rotate AWS Secrets Manager secrets (opens in a new tab)
Explanation
Secrets Manager is built for credentials that must rotate. For an RDS for MySQL user it offers AWS-provided rotation functions (single user or alternating users), so a 30-day schedule needs no custom code. The other half of the requirement is on the application side: it must read the secret at run time, not copy it into configuration, or it falls out of date after the first rotation.
Want more on Secrets management? The 5 full-length practice sets have 10 more Secrets management questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →