A company is implementing a serverless architecture by using AWS Lambda functions that need to access a Microsoft SQL Server DB instance on Amazon RDS. The company has separate environments for development and production, including a clone of the database system. The company's developers are allowed to access the credentials for the development database. However, the credentials for the production database must be encrypted with a key that only members of the IT security team's IAM user group can access. This key must be rotated on a regular basis. What should a solutions architect do in the production environment to meet these requirements?
Select one answer.
Marked answer: D
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose D1
he deciding factor is the requirement for regular credential rotation—Secrets Manager is the only option that handles this automatically. Parameter Store lacks native RDS credential rotation, making it unsuitable compared to Secrets Manager's purpose-built rotation capabilities. Options B and C fail because they either use default encryption keys outside IT control or rely on environment variables without rotation support, whereas D combines Secrets Manager's automatic credential rotation with customer-managed KMS encryption for full security oversight.
Chose D1
Secrets Manager is the right place for DB creds; integrates cleanly with Lambda. KMS customer managed key → IT security controls access and key rotation. IAM: Lambda execution role gets read/decrypt; humans restricted to IT security. → Therefore, D best matches security, key rotation, and operational best practice.
2
Answer should be A , As we are talking of encryption Key rotation by customer IT key responisble person and not the database credential rotation
