Question

During an incident, the security team confirms that an attacker obtained the master database credentials for a production Amazon Aurora cluster after gaining temporary access to an application server. The credentials are stored in AWS Secrets Manager and consumed by several ECS tasks. The team has already contained the attacker's access to the application server. For the eradication phase, they must rotate the compromised credentials with minimal application downtime and ensure the running tasks pick up the new secret automatically. Which approach best meets these requirements?

Accepted Answer

Enable Secrets Manager rotation using the provided Aurora rotation Lambda with the alternating-users strategy, and configure the application to retrieve the secret at runtime rather than caching it indefinitely.

Answer

Manually change the Aurora master password in the RDS console, then update the value in Secrets Manager and force a full redeployment of every ECS service.

Answer

Delete the existing secret in Secrets Manager and create a new secret with a different name, then update each ECS task definition to reference the new secret ARN.

Answer

Attach a resource policy to the secret that denies the compromised IAM principal, leaving the credential value unchanged since access has been contained.