The business-license renewal Lambda must obtain RDS credentials at…

Question

The business-license renewal Lambda must obtain RDS credentials at runtime with managed rotation, not from a checked-in .env file in the repository. Which approach meets that requirement?

Accepted Answer

Retrieve credentials from AWS Secrets Manager (with rotation) at runtime using the function's IAM role — Checked-in .env files are yesterday's USB stick under the keyboard. Let the Lambda ask Secrets Manager for the current RDS password when it runs, with rotation doing the heavy lifting.

Answer

Commit a production .env to a private Git branch and load it during SAM build

Answer

Hard-code the password in the handler and rotate it by editing source every 30 days

Answer

Email the DBA password to the on-call chat after each deploy so nobody needs a secret store

The business-license renewal Lambda must obtain RDS credentials at runtime with managed rotation, not from a checked-in .env file in the repository. Which approach meets that requirement?

Short Explanation

Full Explanation