A database password must rotate automatically every 30 days with zero application code changes. Which service provides built-in automatic rotation with Lambda-based rotation workflows?
A.AWS Secrets Manager
Managed rotation is Secrets Manager's signature feature. Correct.
B.SSM Parameter Store (SecureString)
SecureString encrypts storage but has no built-in rotation engine.
C.AWS KMS
KMS encrypts data — it doesn't manage credential lifecycle.
D.Encrypted environment variables
Env vars are static values — rotation requires redeploys.
Why this answer
Secrets Manager's differentiator over Parameter Store is NATIVE rotation — it manages the rotation Lambda and updates the database credential for supported engines automatically. Parameter Store stores secrets cheaply but rotation is DIY. KMS encrypts keys; env vars are static and visible in configs.
Correct answer: A · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM & Access Control practice session.
Practice IAM & Access Control