These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-004
An application connects to RDS for MySQL. You do not want to store DB credentials in source code or environment variables in plaintext. Which service is the most appropriate for storing credentials securely with periodic rotation in mind?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: C. AWS Secrets Manager
Explanation
Secrets such as DB passwords can be managed with AWS Secrets Manager. It also supports integration and rotation with RDS.
Per-choice explanations
A. A public Amazon S3 bucket
Incorrect. Storing secrets in a public bucket is a serious security risk.
B. Amazon CloudWatch Logs
Incorrect. CloudWatch Logs is a log storage service, not a destination for secrets.
C. AWS Secrets Manager
Correct. It is well suited to secret management and rotation.
D. AWS Budgets
Incorrect. AWS Budgets is a billing monitoring service.
Practical Use
AWS Secrets Manager is a managed service for securely storing and retrieving sensitive information such as database passwords, API keys, and OAuth tokens. For databases such as RDS, Aurora, and Redshift, Secrets Manager directly supports rotation. The standard operational pattern is to rotate passwords periodically through a Lambda-based rotation function and synchronize them with the DB. The application retrieves the secret via the Secrets Manager API (or the SDK's automatic caching), so plaintext credentials never end up in code or environment variables. A similar service is the SecureString parameter in AWS Systems Manager Parameter Store. The standard tier is free, but automatic rotation is not provided out of the box (you must configure Lambda yourself). The common rule of thumb is to use Parameter Store when there are few secrets or for static secrets that do not require rotation (such as external API keys), and Secrets Manager for cases such as databases that need automatic rotation. Secrets Manager charges a fixed monthly fee per secret and per API call, so choose based on the balance of cost and operational overhead. On SAA-C03, Secrets Manager is the correct answer for requirements such as "store DB credentials securely and rotate periodically" or "avoid hardcoding or plaintext environment variables." The distractors that name CloudWatch Logs or a public S3 bucket as the storage location are the classic pattern of pointing at a service intended for a different purpose (log use or public storage). Comparison with Parameter Store SecureString and per-secret access control with IAM policies are also asked on higher exams.