A team stores a database password that must rotate automatically on a schedule, with AWS managing the rotation workflow rather than the team building their own scheduling logic. Separately, they store a handful of static configuration values that never change and need no rotation at all. Which pairing of AWS services best fits these two needs respectively?
- AWS Secrets Manager for the password, using its built-in rotation support; AWS Systems Manager Parameter Store SecureString parameters for the static configuration values
- AWS Systems Manager Parameter Store for the password, because it offers built-in automatic rotation for any secret type; AWS Secrets Manager for the static values
- Amazon Cognito for the password rotation; AWS KMS for storing the static configuration values
- AWS Certificate Manager for the password; Amazon S3 Object Lock for the static configuration values
Why A? And why not the others?
Correct answer: A. AWS Secrets Manager for the password, using its built-in rotation support; AWS Systems Manager Parameter Store SecureString parameters for the static configuration values
AWS Secrets Manager provides a managed rotation workflow, including AWS-supplied Lambda rotation function templates for services like RDS, so a scheduled rotation can be configured without the team writing their own cron-based orchestration, making it the right fit for the password; Systems Manager Parameter Store SecureString parameters are a lighter-weight, encrypted option well suited to static values that do not need that managed rotation workflow. The option reversing the pairing is wrong because Parameter Store has no built-in, managed rotation orchestration comparable to Secrets Manager's; any rotation logic for a parameter would have to be built and scheduled entirely by the team itself, which contradicts the requirement that AWS manage the workflow. The option pairing Cognito and KMS is wrong because Cognito user pools authenticate end users of an application and have no facility for rotating an arbitrary database password, and KMS manages encryption keys rather than storing configuration values themselves. The option pairing Certificate Manager and S3 Object Lock is wrong because ACM only issues and renews TLS certificates, not database credentials, and S3 Object Lock is a write-once-read-many retention control unrelated to storing or serving configuration values.
Source: AWS documentation: AWS Secrets Manager rotation and AWS Systems Manager Parameter Store