A company runs an application on Amazon EC2 instances. The EC2 instances open connections to an Amazon RDS for SQL Server database. A developer needs to store and access the credentials and wants to automatically rotate the credentials. The developer does not want to store the credentials for the database in the code. Which solution will meet these requirements in the MOST secure way?
- ACreate an IAM role that has permissions to access the database. Attach the IAM role to the EC2 instances.
- BStore the credentials as secrets in AWS Secrets Manager. Create an AWS Lambda function to update the secrets and the database. Retrieve the credentials from Secrets Manager as needed. (correct answer)
- CStore the credentials in an encrypted text file in an Amazon S3 bucket. Configure the EC2 instance launch template to download the credentials from Amazon S3 as the instance launches. Create an AWS Lambda function to update the secrets and the database.
- DStore the credentials in an Amazon DynamoDB table. Configure an Amazon CloudWatch Events rule to invoke an AWS Lambda function to periodically update the secrets and database.
Reveal answer & explanationHide answer
The correct answer is B. Option B: Store the credentials as secrets in AWS Secrets Manager. Create an AWS Lambda function to update the secrets and the database. Retrieve the credentials from Secrets Manager as needed.
Explanation
AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.