Question

A financial services company runs a web application on Amazon EC2 that connects to an Amazon RDS for PostgreSQL database. During a security audit, it was found that the database password is hard-coded in the application configuration file and has not changed in over a year. The security team requires that database credentials be stored securely and automatically rotated every 30 days without requiring application redeployment. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store the credentials in AWS Secrets Manager, enable automatic rotation with the built-in RDS rotation Lambda function, and update the application to retrieve the secret at runtime.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString and write a scheduled Lambda function to manually update and rotate the password.

Answer

Encrypt the configuration file with AWS KMS and configure a cron job on the EC2 instance to decrypt and rotate the database password every 30 days.

Answer

Move the credentials to environment variables on the EC2 instance and use IAM database authentication tokens that expire after 30 days.