Which solution will meet these requirements in the MOST operationally efficient manner?
Store the database password as an environment variable for each Lambda function. Create a new Lambda function that is named PasswordRotate. Use Amazon EventBridge to schedule the PasswordRotate function every 30 days to change the database password and update the environment variable for each Lambda function.
Use AWS Key Management Service (AWS KMS) to encrypt the database password and to store the encrypted password as an environment variable for each Lambda function. Grant each Lambda function access to the KMS key so that the database password can be decrypted when required. Create a new Lambda function that is named PasswordRotate to change the password every 30 days.
Use AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from Secrets Manager.
Use AWS Systems Manager Parameter Store to create a secure string to store credentials for the database. Create a new Lambda function called PasswordRotate. Use Amazon EventBridge to schedule the PasswordRotate function every 30 days to change the database password and to update the secret within Parameter Store. Update each Lambda function to access the database password from Parameter Store.
Explanations:
Storing the database password as an environment variable is not secure, as environment variables are accessible in plaintext within the Lambda function’s configuration. Rotating the password manually via a custom Lambda function introduces additional complexity and operational overhead.
While KMS can encrypt the password, storing the encrypted password as an environment variable still does not fully meet the requirement to securely manage and rotate the credentials. Decryption would still require manual effort, and password rotation would need to be managed by custom code.
AWS Secrets Manager is designed for securely storing and automatically rotating secrets, including database credentials. By enabling automatic rotation with a schedule of 30 days, this solution ensures that the password is never stored in plaintext and is rotated without manual intervention. Lambda functions can be updated to retrieve the password securely from Secrets Manager.
While AWS Systems Manager Parameter Store can store credentials securely, the solution requires manual management of password rotation via a custom Lambda function. It adds unnecessary complexity and does not offer automatic password rotation, unlike AWS Secrets Manager.
I figure that the answer is:
Use AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from Secrets Manager.