AWS Certified Solutions Architect – Associate (SAA-C03) — Question 4

A company has an application that runs on Amazon EC2 instances and uses an Amazon Aurora database. The EC2 instances connect to the database by using user names and passwords that are stored locally in a file. The company wants to minimize the operational overhead of credential management.
What should a solutions architect do to accomplish this goal?

Answer options

• A. Use AWS Secrets Manager. Turn on automatic rotation.
• B. Use AWS Systems Manager Parameter Store. Turn on automatic rotation.
• C. Create an Amazon S3 bucket to store objects that are encrypted with an AWS Key Management Service (AWS KMS) encryption key. Migrate the credential file to the S3 bucket. Point the application to the S3 bucket.
• D. Create an encrypted Amazon Elastic Block Store (Amazon EBS) volume for each EC2 instance. Attach the new EBS volume to each EC2 instance. Migrate the credential file to the new EBS volume. Point the application to the new EBS volume.

Correct answer: A

Explanation

The correct answer is A, as AWS Secrets Manager is designed specifically for managing and rotating credentials with minimal operational overhead. Option B, while also a valid choice for parameter management, does not specialize in secret rotation as effectively as Secrets Manager. Options C and D involve more complex and less secure methods of storing credentials, which do not effectively minimize operational overhead.