An internal reporting service on EC2 reads its database password from a file on disk, and an audit found that anyone with shell access can read it. The company wants encrypted storage, automatic rotation, and access logging tied to the instance's identity. What should the team do?
Show answer and explanation
Answer: D
AWS Secrets Manager encrypts stored values with KMS, supports automatic rotation for supported database engines, and records each retrieval in CloudTrail. Granting the instance profile role permission to read the secret means no plaintext password sits on disk, and access is tied to the workload's identity rather than shared. Systems Manager Parameter Store with SecureString parameters would also fit where rotation is not required.
Why the other options are wrong
- A. Emailing the password, even as an encrypted attachment, spreads the secret to people who do not need it and leaves no rotation or access audit trail.
- B. A public repository exposes the credential to anyone on the internet, which is the opposite of the protection the audit asked for.
- C. Baking the password into an AMI copies the same plaintext secret into every instance and every snapshot, and changing it means rebuilding images.