An application connects to RDS.
Do not store the password in source code and update it regularly.
Which service is most appropriate?
Store the database secret in AWS Secrets Manager and configure rotation with controlled retrieval permissions.
Detailed explanation
Encryption, rotation, and detailed retrieval auditing are not provided by this design alone.
Encryption, rotation, and detailed retrieval auditing are not provided by this design alone.
DNS is not a secure secret-management service.
DNS is not a secure secret-management service.
An environment variable alone does not provide a managed rotation and audit lifecycle.
An environment variable alone does not provide a managed rotation and audit lifecycle.
Secrets Manager securely stores secrets and supports credential rotation for supported services.
Secrets Manager securely stores secrets and supports credential rotation for supported services.
Check official documentation
Compare the following points with the official documentation.
AWS Secrets Manager rotationの公式説明を確認する。
What to confirm
機密情報の保管、取得権限、ローテーションを分離して設計できる。
Key points
- AWS Secrets Manager
- Rotation
- RDS credentials
Notes
- Environment: AWS公式Secrets Manager・RDSドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Secret lifecycle
Storage, retrieval permissions, and rotation should be managed as one controlled lifecycle.
Transport and storage
A private object or DNS record does not by itself provide secret rotation and audit controls.