A company stores the master password for an "Amazon RDS for PostgreSQL" database in "AWS Secrets Manager". Compliance requires the password to change automatically every 30 days, the database must keep working through each change, and the team wants the least custom code to build and maintain. Which approach BEST meets these requirements?
- ASchedule an "Amazon EventBridge" rule every 30 days to invoke an "AWS Lambda" function the team writes that resets the database password and overwrites the stored secret value in place.
- BStore the password in a "Parameter Store" "SecureString" parameter and rely on creating a new parameter version every 30 days to roll the credential forward for the database.
- CEnable "Secrets Manager" managed rotation on the secret using the provided "Amazon RDS" rotation function and set the rotation schedule to every 30 days. Correct
- DTurn on "Secrets Manager" rotation but point it at a fully custom Lambda function the team authors to call the database and update the secret every 30 days.
Why A is wrong: A hand-written Lambda triggered by EventBridge can change the password on a schedule, but it makes the team build and maintain the rotation logic and risks downtime during the swap, which is more overhead than the managed rotation the requirement wants.
Why B is wrong: Parameter Store keeps version history and encrypts the value, but it has no built-in rotation, so a new version does not change the password on the database, leaving the 30-day automatic-rotation requirement unmet.
Why C is correct: Managed rotation uses the AWS-provided RDS rotation function to update the password on the database and in the secret together on the chosen schedule, using a staged approach that keeps connections working, with no custom rotation code to maintain.
Why D is wrong: A custom rotation Lambda is appropriate when no managed function fits, but for a standard RDS database it duplicates logic AWS already provides, so it adds build and maintenance effort that the managed RDS rotation function removes.