An organisation runs several AWS accounts and wants employees to sign in once to reach the accounts they are entitled to, and it also needs database passwords stored securely with automatic rotation. Which two AWS services together meet these needs? (Select TWO.)
- AAWS IAM Identity Center to give employees one sign-in that reaches the accounts they are entitled to use. Correct
- BAWS Secrets Manager to store the database passwords securely and rotate them automatically on a schedule. Correct
- CAmazon CloudWatch to collect the database passwords centrally and present them to staff at each sign-in.
- DAWS Config to record one sign-in for employees and to keep the database passwords rotated on a schedule.
- EAWS CloudTrail to grant employees a single sign-on and to hold the database passwords for the application.
Why A is correct: IAM Identity Center provides centralised single sign-on across multiple accounts from one set of credentials.
Why B is correct: Secrets Manager safeguards credentials such as database passwords and can rotate them automatically without code changes.
Why C is wrong: CloudWatch monitors metrics and logs, but it neither stores secret credentials nor handles employee sign-in.
Why D is wrong: Config tracks resource configuration history, but it does not provide single sign-on or manage secret rotation.
Why E is wrong: CloudTrail records account API activity for audit, but it offers no sign-on portal and stores no credentials.