SAA-C03 - Design Secure Architectures (30% of the exam) - Section 1.5

Manage application secrets and credentials securely using AWS Secrets Manager, Systems Manager Parameter Store and Amazon Cognito.

Describe how AWS Secrets Manager stores and automatically rotates credentials such as database passwords, and contrast it with Systems Manager Parameter Store for storing configuration values. Recognise when Amazon Cognito is the appropriate service for managing application user identities and issuing tokens rather than using IAM credentials directly.

AWS Secrets ManagerParameter StoreSecret rotationAmazon Cognito

Practice question for this objective

Free sampleDesign Secure Architecturesmedium

A company runs an application on Amazon EC2 that connects to an Amazon RDS for PostgreSQL database using a username and password. Security policy requires that the database password be changed automatically every 30 days with no manual steps and no application downtime. Which approach meets these requirements with the least operational overhead?

AStore the credentials in AWS Secrets Manager and enable managed rotation with a 30 day schedule so the password is updated in both the secret and the database automatically. Correct
BStore the credentials as a SecureString parameter in Systems Manager Parameter Store and write a scheduled Lambda function to overwrite the value monthly.
CStore the credentials in AWS Systems Manager Parameter Store as a standard parameter and rely on parameter version history to track each monthly password change.
DStore the database password directly in the EC2 instance user data script and replace the launch template version every month to introduce a new password.

Use AWS Secrets Manager managed rotation to change database credentials automatically on a schedule without downtime. Secrets Manager integrates with supported databases such as RDS to rotate credentials on a schedule using a rotation function that updates the database and the stored secret atomically, so applications retrieving the current secret never see an invalid password and no manual work is needed.

Why A is correct: Secrets Manager natively rotates RDS credentials on a defined schedule, updating both the database and the stored secret without manual effort or downtime, meeting the requirement with the least overhead.

Why B is wrong: Parameter Store SecureString encrypts the value but has no native rotation, so you must build and maintain the entire rotation workflow yourself, which is more operational overhead than required.

Why C is wrong: Standard parameters store values in plaintext and version history only records changes, so this neither secures the password nor performs any rotation against the database automatically.

Why D is wrong: User data is readable from instance metadata and is not encrypted, so embedding a password there exposes it and still requires manual launch template edits each month.

See more SAA-C03 practice questions, answers explained.

Exam traps in Design Secure Architectures

Answers that look right on this material and are not. Each one is a distractor from a different question in the SAA-C03 bank for this domain.

Keep the credentials in Systems Manager Parameter Store as a SecureString and schedule an EventBridge rule that triggers a Lambda function to write a new value every 14 days.
Why it is wrong: Parameter Store has no rotation feature, so you must build the schedule, the new-password generation, the database update and error handling yourself, which is more bespoke plumbing than the managed option.
Keep one secret in eu-west-1 and have the us-east-1 stack call the eu-west-1 Secrets Manager endpoint directly, caching the value locally to limit how often it makes the cross-Region call.
Why it is wrong: This still depends on the primary Region being reachable and adds cross-Region latency on cache misses, which is exactly the dependency the requirement for a local endpoint is trying to remove.
Store the credential as a Systems Manager Parameter Store String parameter and read it through environment variables in the task definition.
Why it is wrong: A plain String parameter is not encrypted and Parameter Store does not rotate secrets on its own, so this fails both the encryption and rotation requirements.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.