Question

A financial services company stores database credentials, third-party API keys, and application configuration flags. Security requires that all database credentials be automatically rotated every 30 days, that secrets be encrypted with a customer-managed KMS key, and that access be auditable. The team also wants to minimize cost for the hundreds of non-sensitive configuration flags used by their applications. Which approach best meets ALL of these requirements?

Accepted Answer

Store database credentials in AWS Secrets Manager with automatic rotation enabled and a customer-managed KMS key; store the non-sensitive configuration flags in SSM Parameter Store standard parameters.

Answer

Store all values (credentials, API keys, and configuration flags) in AWS Secrets Manager encrypted with a customer-managed KMS key and enable automatic rotation on every secret.

Answer

Store all values in SSM Parameter Store SecureString parameters encrypted with a customer-managed KMS key, and use an EventBridge scheduled Lambda to rotate every parameter every 30 days.

Answer

Store database credentials in SSM Parameter Store advanced parameters with a rotation policy, and store the configuration flags in Secrets Manager to leverage its versioning.