Question

A machine learning team runs a nightly SageMaker training job that pulls features from an Amazon RDS PostgreSQL database. The database credentials are currently hardcoded in the training script stored in a Git repository, and a recent security audit flagged this as a critical finding. The team must remove the plaintext credentials, support automatic credential rotation without code changes, and grant the training job least-privilege access to retrieve the secret at runtime. Which approach best satisfies these requirements?

Accepted Answer

Store the credentials in AWS Secrets Manager with rotation enabled, and grant the SageMaker training job's IAM execution role permission to call secretsmanager:GetSecretValue for that specific secret ARN.

Answer

Move the credentials into a SageMaker training job hyperparameter and pass them at job submission time so they are never committed to Git.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a plaintext String parameter and reference it from the training script.

Answer

Encrypt the credentials with a KMS key, commit the ciphertext to Git, and have the training script decrypt them at runtime using the execution role.