An ETL job connects to Aurora.
Keep the password out of code and plaintext configuration, and rotate it regularly.
Which authentication approach is most appropriate?
Store the secret in Secrets Manager and let the execution role retrieve it when needed.
Detailed explanation
Audit events do not create database authentication secrets.
Audit events do not create database authentication secrets.
A permission mistake would expose the credential.
A permission mistake would expose the credential.
The encrypted secret can be fetched through an audited API and rotated.
The encrypted secret can be fetched through an audited API and rotated.
Source, logs, and backups can expose the long-lived value.
Source, logs, and backups can expose the long-lived value.
Check official documentation
Compare the following points with the official documentation.
AWS Secrets Manager、rotation、KMS encryption、IAM policyの公式説明を確認する。
What to confirm
コード直書き・公開S3と、秘密管理サービスの役割を説明できる。
Key points
- Secrets Manager
- Rotation
- KMS
- DB credentials
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Retrieval path
Do not expose the secret in logs or error messages; fetch it only when needed.
Coordination
Change the database credential and refresh connection pools safely.