An application stores RDS database credentials in a configuration file. The security team requires centralized secret storage with built-in automatic rotation. Which service should be used?
A.AWS Systems Manager Parameter Store with manual rotation
Parameter Store can hold secrets (SecureString) but automatic credential rotation for RDS is a native Secrets Manager feature.
B.AWS Secrets Manager with automatic rotation enabled
Correct. Secrets Manager offers built-in automatic rotation for RDS credentials.
C.Amazon S3 with bucket versioning
Versioned S3 objects are still plaintext files; no rotation or access auditing for secrets is provided.
D.EC2 user data scripts
User data is visible to anyone who can describe the instance — a well-known credential leak.
Why this answer
AWS Secrets Manager is purpose-built for secrets: it encrypts them with KMS, provides fine-grained IAM access, and supports automatic rotation for RDS and other services via managed Lambda rotation functions.
Correct answer: B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Protection & Encryption practice session.
Practice Data Protection & Encryption