Question

A CloudOps engineer is writing a CloudFormation template to provision an Amazon RDS MySQL instance. Company policy prohibits storing database credentials in plaintext anywhere in the template or in source control, and the master password must be generated automatically and stored securely. Which approach meets these requirements with the least operational effort?

Accepted Answer

Create an AWS::SecretsManager::Secret resource with a GenerateSecretString property, then reference it in the RDS instance's MasterUserPassword using a Secrets Manager dynamic reference (resolve:secretsmanager).

Answer

Pass the master password as a NoEcho CloudFormation parameter at stack creation time and store the value in an encrypted S3 object for later retrieval.

Answer

Store the password as a SecureString parameter in Parameter Store beforehand and hardcode the plaintext ARN and value as a template Mapping.

Answer

Use a Lambda-backed custom resource to generate a random password and return it as a stack output for administrators to copy into the RDS console.