Question

A SysOps administrator manages an application that connects to an Amazon RDS for MySQL database using a static password stored in a configuration file. Security auditors require that the database credentials be rotated automatically every 30 days without any application downtime, and that the plaintext password no longer be stored in application files. What should the administrator implement to meet these requirements with the least operational overhead?

Accepted Answer

Store the credentials in AWS Secrets Manager, enable automatic rotation with the provided RDS rotation Lambda function, and update the application to retrieve the secret at runtime via the Secrets Manager API.

Answer

Store the credentials in an AWS Systems Manager Parameter Store SecureString parameter and create an EventBridge scheduled rule that triggers a custom Lambda function every 30 days to change the password.

Answer

Store the credentials in AWS Secrets Manager without rotation enabled, and manually update the secret value every 30 days while restarting the application to pick up the new password.

Answer

Encrypt the configuration file with an AWS KMS customer managed key and set the key policy to rotate the key material every 30 days.