SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Systems Manager Parameter Store with SecureString parameters.

  Why it's wrong here

  Parameter Store is a valid choice for storing configuration data and secrets, but it does not offer built-in, automated rotation for database credentials. Secrets Manager is the specialized service for this requirement, providing a more robust and native integration for rotation logic compared to the manual processes needed with Parameter Store.

• ✗

  AWS Key Management Service (KMS) to encrypt the environment variables.

  Why it's wrong here

  AWS KMS is used to create and manage cryptographic keys to encrypt data, but it is not a secret storage service. While it can be used to encrypt credentials stored in environment variables, it does not handle the lifecycle management or the automatic rotation of the underlying secrets themselves.

• ✓

  AWS Secrets Manager with its built-in rotation feature for Amazon RDS.

  Why this is correct

  AWS Secrets Manager provides native support for rotating credentials for RDS, Redshift, and DocumentDB. It can automatically update the password in the database and the secret value simultaneously, ensuring that the application always has access to current credentials without storing them in insecure environment variables.

• ✗

  AWS Identity and Access Management (IAM) roles for the Lambda function.

  Why it's wrong here

  IAM roles provide temporary security credentials for AWS service requests but do not store third-party or database-specific credentials like MySQL passwords. While IAM should be used to give Lambda permission to access Secrets Manager, it cannot replace the need for a dedicated secret management and rotation service.