An application stores a third-party database password that must rotate automatically every 30 days without code changes. Which service is designed for this?
A.SSM Parameter Store standard parameters
Parameter Store holds values but has no built-in rotation engine.
B.AWS Secrets Manager
Correct. Automatic, scheduled rotation is Secrets Manager's headline feature.
C.Encrypted environment variables in Lambda
Encrypted env vars are static — rotation requires redeployment.
D.An encrypted file in S3
A file in S3 is manual secret management with worse controls.
Why this answer
Secrets Manager natively supports automatic rotation via Lambda rotation functions (built-in for RDS/DocumentDB, custom for others), versioning, and fine-grained access. Parameter Store stores values but doesn't rotate them automatically.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security