Question

A development team stores an application's Amazon RDS database credentials in AWS Secrets Manager. Compliance now requires that these credentials be automatically changed every 30 days without any code changes to the application and without downtime. The application retrieves the secret at runtime using the AWS SDK. What is the MOST appropriate way to meet this requirement?

Accepted Answer

Enable automatic rotation on the Secrets Manager secret using a rotation Lambda function and set the rotation schedule to 30 days.

Answer

Move the credentials to a Systems Manager Parameter Store SecureString parameter and configure a 30-day expiration policy.

Answer

Write a scheduled EventBridge rule that emails the team every 30 days to manually update the password in Secrets Manager.

Answer

Store the credentials as encrypted Lambda environment variables and redeploy the function every 30 days with new values.