Rotate an RDS credential on a schedule.
Deliver the new value safely to the application.
Which service is most appropriate?
Configure Secrets Manager rotation to store and regularly change the RDS credential.
Detailed explanation
The credential can leak through source control or logs.
The credential can leak through source control or logs.
DNS is not a secret-management service.
DNS is not a secret-management service.
Secrets Manager combines secret storage, rotation, and the RDS update workflow.
Secrets Manager combines secret storage, rotation, and the RDS update workflow.
S3 lifecycle management does not update database credentials.
S3 lifecycle management does not update database credentials.
Check official documentation
Compare the following points with the official documentation.
AWS Secrets Manager rotation for RDSの公式説明を確認する。
What to confirm
シークレット保管とLambdaの一般処理を区別できる。
Key points
- Secrets Manager
- Rotation
- RDS password
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Secret lifecycle
Storage, rotation, retrieval, and audit form one credential-management lifecycle.
Consumer update
The application must retrieve the current value rather than keep a stale embedded copy.