A development team is using AWS CloudFormation to provision an Amazon RDS database. The database credentials (username and password) need to be securely stored and automatically rotated. When provisioning the RDS instance via CloudFormation, these credentials should be passed without hardcoding them in the template, and the application should retrieve them dynamically at runtime. Which AWS service integration with CloudFormation best supports this requirement?
- AAWS Systems Manager Parameter Store with SecureString.
- BAWS Key Management Service (KMS) for encryption.
- CDirect CloudFormation 'NoEcho' parameters.
- DAWS Secrets Manager with CloudFormation dynamic references.
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Secrets Manager with CloudFormation dynamic references.
AWS Secrets Manager is designed for securely storing, managing, and automatically rotating secrets like database credentials. CloudFormation's dynamic references allow direct integration with Secrets Manager, enabling the database password to be retrieved securely at provisioning time and rotated automatically, without hardcoding or exposing the secret in the template.
Why the other options are wrong
- A. Parameter Store with SecureString can store secrets but doesn't offer built-in automatic rotation for database credentials.
- B. KMS encrypts data but doesn't manage or rotate secrets itself; it's a component used by Secrets Manager.
- C. NoEcho parameters hide input during creation but don't store or rotate secrets securely or allow dynamic retrieval by applications.
Secrets Manager with CloudFormation
AWS Secrets Manager securely stores, manages, and automatically rotates database credentials and other secrets. CloudFormation can integrate with Secrets Manager using dynamic references to retrieve these secrets during stack creation or updates, ensuring secrets are never hardcoded in templates and are managed securely.
- Stores secrets securely (encrypted at rest and in transit).
- Offers automatic rotation for various database types.
- CloudFormation uses dynamic references to retrieve secrets at deploy time.
- Applications retrieve secrets dynamically at runtime from Secrets Manager.
Memory trick: Secrets Manager is your vault for CloudFormation's dynamic secrets.