What should the solutions architect recommend to meet these requirements?
Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Enforce HTTPS on the connection to Amazon S3 during data transfers.
Save the database credentials in AWS Systems Manager Parameter Store. Set up password rotation on the credentials in Parameter Store. Change the IAM role for the Lambda function to allow the function to access Parameter Store. Modify the Lambda function to retrieve the credentials from Parameter Store. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
Save the database credentials in AWS Secrets Manager. Set up password rotation on the credentials in Secrets Manager. Change the IAM role for the Lambda function to allow the function to access Secrets Manager. Modify the Lambda function to retrieve the credentials from Secrets Manager. Enforce HTTPS on the connection to Amazon S3 during data transfers.
Explanations:
Enabling IAM database authentication reduces the risk if database credentials are compromised. Using an IAM role for Lambda to access Aurora with IAM authentication removes static credentials. The VPC endpoint ensures traffic stays within the AWS network.
Although IAM database authentication is implemented, enforcing HTTPS to access S3 does not prevent traffic from traveling over the internet. This does not satisfy the requirement that data should not travel across the internet.
Using AWS Systems Manager Parameter Store with rotation adds security for credentials, but it still relies on static credentials and doesn’t minimize compromise impact as effectively as IAM authentication. The VPC endpoint is correctly used for S3 traffic.
AWS Secrets Manager with rotation secures the credentials, but the requirement for network isolation is unmet by only enforcing HTTPS. This setup does not prevent data from traveling over the internet, unlike a VPC endpoint.