A company requires the rotation of administrative credentials for production workloads on a regular basis. A CloudOps engineer must implement this policy for an Amazon RDS DB instance's master user password. Which solution will meet this requirement with the LEAST operational effort?

AWS Secrets Manager is the purpose-built service for managing the lifecycle of secrets, including credentials for services like Amazon RDS. It offers a fully managed, out-of-the-box solution for automatic password rotation. By creating a secret for the RDS database and enabling rotation, Secrets Manager automatically provisions and manages an AWS Lambda function to handle the entire rotation process. This approach requires only configuration and eliminates the need to write, test, or maintain custom code, thereby representing the least operational effort to meet the requirement.

A. This is a valid but high-effort solution. It requires the engineer to write, deploy, and maintain a custom Lambda function and its associated permissions, which is more operational overhead than the managed Secrets Manager solution.
B. AWS Systems Manager Parameter Store does not have a native, built-in capability to automatically rotate credentials for external services like Amazon RDS. A custom solution, such as a Lambda function, would still be required.
C. This option is incorrect for two reasons: it uses a plain String parameter, which is insecure for storing passwords, and Parameter Store does not natively support automatic rotation for RDS credentials. ---

1. AWS Secrets Manager User Guide, "Rotate secrets": "For secrets that store credentials for Amazon RDS... you can configure Secrets Manager to rotate the secret automatically. When you turn on automatic rotation, Secrets Manager uses a Lambda rotation function to rotate the secret." This document confirms that Secrets Manager provides a managed, automatic rotation feature specifically for RDS.

2. AWS Secrets Manager User Guide, "How rotation works": This section details the four-step process (createSecret, setSecret, testSecret, finishSecret) that the managed Lambda function performs, illustrating the complexity that is abstracted away from the user, thus minimizing operational effort.

3. AWS Systems Manager User Guide, "AWS Systems Manager Parameter Store": The documentation for Parameter Store describes its function for storing configuration data and secrets as parameters. It does not mention a native, managed feature for rotating credentials of other AWS services like RDS, which differentiates it from Secrets Manager.

4. AWS Security Blog, "AWS Secrets Manager vs. Systems Manager Parameter Store": "Secrets Manager offers secret rotation with built-in integration for Amazon RDS... If you need to rotate secrets, you should use Secrets Manager." This official blog post explicitly recommends Secrets Manager over Parameter Store for use cases involving credential rotation.