AWS Certified Solutions Architect Professional SAP-C02 Practice Question

AWS Secrets Manager is purpose-built for centrally storing, automatically rotating, and auditing access to secrets. A secret can be created once in the security account, encrypted with a customer-managed KMS key, and shared with application IAM roles in other accounts through a resource-based policy that grants only GetSecretValue. Secrets Manager provides a managed Lambda rotation function that updates the secret on a fixed schedule without requiring service downtime, and every API call is recorded in AWS CloudTrail for audit.

Systems Manager Parameter Store SecureString parameters can be encrypted and shared, but they do not include built-in rotation; implementing rotation and cross-account replication would require custom Lambda and EventBridge automation. Storing encrypted files in Amazon S3 and distributing them with AWS Batch adds manual rotation effort and increases the attack surface. Embedding credentials in each ECS task definition forces monthly image rebuilds, violates the single-source-of-truth requirement, and risks accidental exposure in container metadata. Therefore the Secrets Manager design is the only option that satisfies all operational, security, and compliance requirements with minimal custom code.