Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 409 discussion

Answer B. Always remember - Automatic Password Rotation - AWS Secrets Manager!

B is perfect

Option B

Option : B is the correct answer While AWS Systems Manager Parameter Store is a valid service for storing configuration data, including secrets, using AWS KMS for encryption and Boto3 for retrieval, it lacks the built-in support for automatic rotation of secrets AWS KMS is primarily designed for managing cryptographic keys and does not provide built-in support for storing and rotating secrets like database credentials. While AWS KMS key rotation is available, it is intended for cryptographic key rotation rather than the rotation of sensitive data like passwords.

The correct solution should be: Store the database credentials for both environments in AWS Secrets Manager with distinct key entry for the QA environment and the production environment. Enable a Lambda function to rotate the secrets regularly. Create a KMS key for each secret and use them to encrypt the credentials. Assign permissions to allow the business Lambda function to retrieve the credential from Secret manager and decrypt the credential with the KMS key. B is not ideal but is the only acceptable answer: “Turn on rotation.”: In Secret Manager, you must enable a Lambda function to rotate the credential “Provide a reference to the Secrets Manager key as an environment variable for the Lambda functions. “ permission must be set to allow the Lambda function to use the Key to decrypt the credential.

Option B

"rotate passwords automatically" -> AWS Secrets Manager

AWS Secrets Manager with Rotation Enabled:

B for sure

Correct Answer is B

Answer: B