Question

A financial services company is building a new microservices application on Amazon ECS Fargate that connects to an Amazon RDS for PostgreSQL database. Security auditors require that the database credentials be encrypted at rest, rotated automatically every 30 days without application downtime, and never stored in container images, task definitions, or environment variables in plaintext. The application must retrieve credentials at runtime using its task IAM role, and access must be scoped so each service can read only its own credential. Which solution meets all requirements with the least operational overhead?

Accepted Answer

Store the credentials in AWS Secrets Manager with automatic rotation enabled using a Lambda rotation function for RDS; grant each ECS task role a resource-scoped IAM policy allowing secretsmanager:GetSecretValue on its specific secret ARN, and reference the secret in the task definition.

Answer

Store the credentials as SecureString parameters in AWS Systems Manager Parameter Store, and schedule an EventBridge rule to trigger a custom Lambda every 30 days to update the password in both RDS and Parameter Store.

Answer

Encrypt the credentials with AWS KMS and store the ciphertext in an S3 bucket, granting each task role read access to its object; have the application decrypt the credentials at startup and cache them for the container lifetime.

Answer

Store the credentials in Secrets Manager without rotation and rely on a nightly CI/CD pipeline job to generate a new password, update RDS, and redeploy all ECS services with the new value baked into the task definition.