Question

A financial services company discovers during an audit that several Lambda functions and ECS tasks read database credentials from environment variables set at deployment time. The security team must remediate this so that credentials are never stored statically in task definitions or function configuration, are automatically rotated every 30 days, and any access to the credentials is captured in a centralized audit trail for compliance reporting. Which approach BEST meets all of these requirements?

Accepted Answer

Store the credentials in AWS Secrets Manager, enable a rotation Lambda with a 30-day schedule, grant the workloads IAM permissions to call GetSecretValue at runtime, and rely on CloudTrail data events / Secrets Manager logging to record each retrieval.

Answer

Store the credentials as SecureString parameters in SSM Parameter Store encrypted with a KMS CMK, reference them in the task definitions using valueFrom, and use a scheduled EventBridge rule to overwrite the parameters every 30 days.

Answer

Keep the credentials in environment variables but encrypt the task definitions and function configuration with a customer-managed KMS key, and enable AWS Config to detect when credentials change.

Answer

Store the credentials in AWS Secrets Manager, but inject them into environment variables at deploy time using a CodePipeline stage so the workloads do not call the API at runtime, and rotate them manually each month.