Question

A security engineer must store database credentials for a fleet of applications. The requirements are: automatic credential rotation every 30 days without custom code for a supported Amazon RDS engine, encryption at rest with a customer managed KMS key, and per-secret resource policies to grant read access to specific IAM roles. Which AWS service and configuration best meets ALL of these requirements at the lowest operational overhead?

Accepted Answer

AWS Secrets Manager with the built-in RDS rotation configuration, encrypted using a customer managed KMS key, and resource-based policies attached to each secret

Answer

AWS Systems Manager Parameter Store SecureString parameters encrypted with a customer managed KMS key, using a scheduled Lambda function to rotate the credentials

Answer

AWS Secrets Manager storing secrets encrypted with the AWS managed aws/secretsmanager key and IAM identity-based policies only

Answer

AWS Systems Manager Parameter Store advanced parameters with policies for expiration, encrypted using an AWS managed KMS key