AWS Certified Data Engineer Associate DEA-C01 Practice Question

A data engineering team manages a MySQL database hosted on Amazon RDS. Compliance requires that the application password be rotated automatically every 30 days without manual scripting. The analytics pipeline runs on AWS Lambda functions in the same account. Which approach meets the requirement while minimizing operational overhead?

Set the master password in Amazon RDS to the keyword AWS_ROTATE to enable automatic rotation and allow Lambda to read the password from the DB instance endpoint.
Encrypt the password with AWS KMS, save it in a Lambda environment variable, and update the variable manually through a CI/CD pipeline each month.
Store the password in AWS Secrets Manager, enable the built-in RDS MySQL rotation schedule, and grant the Lambda execution role permission to retrieve the secret.
Store the password in AWS Systems Manager Parameter Store as a SecureString and use an EventBridge rule to trigger a custom Lambda function to rotate it every 30 days.

Report Issue

Answer Description

AWS Secrets Manager offers a built-in rotation feature for Amazon RDS databases. Enabling a rotation schedule creates an AWS-managed Lambda function that updates the database password and stores the new value in the same secret, eliminating the need for custom scripts. The Lambda functions in the pipeline can fetch the current password at run time by using an execution role that has secretsmanager:GetSecretValue permission.

AWS Systems Manager Parameter Store SecureString cannot rotate credentials automatically; implementing rotation would require a custom rule and script. Storing a KMS-encrypted value in Lambda environment variables still requires a manual update process, and Amazon RDS does not support a keyword such as AWS_ROTATE to trigger automatic password changes. Therefore, using AWS Secrets Manager with built-in rotation is the only option that satisfies the 30-day rotation requirement with the least operational effort.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.