A bank rotates its RDS master password by hand and has missed two rotations. The application reads the password from an environment variable set in the task definition. Operations wants automatic rotation and one place for the application to fetch the current value. What should they use?
Select an answer to reveal the explanation.
Short Explanation
A password baked into the task definition is a spare key under the doormat, and someone has to remember to cut a new one. You let Secrets Manager rotate it and hand the application the current value when it asks. A world-readable object is the doormat moved onto the sidewalk.
Full Explanation
Secrets Manager stores the secret, can rotate an RDS password with a rotation function on a schedule, and gives the application an API to read the current version. That covers the missed manual rotations and removes the need to bake the value into the task definition. A public parameter exposes the password to anyone who can read parameters in the account design they described, and a standard parameter is not the rotation service this requirement names. An object granted to everyone publishes the secret. Writing the password to CloudWatch Logs spreads it into a log system and is not a retrieval API for the application. Caveat: the task role needs secretsmanager:GetSecretValue on that secret, and rotation has to complete once in a test window before you delete the old environment variable. Operational check: confirm the secret's rotation configuration shows a successful rotation and that the application reads the secret instead of the task definition value.