An application was migrated from an on-premises MySQL database to Amazon RDS for MySQL. The application must connect to the RDS instance without using long-term database credentials. Which solution satisfies this requirement?
Choose an answer
Tap an option to check your answer.
Correct answer: Enable IAM database authentication on the RDS for MySQL instance. Create an appropriate IAM role with minimum permissions and assign that role to the application..
Why this is the answer
Enabling IAM database authentication for Amazon RDS for MySQL allows applications to connect using AWS IAM credentials instead of traditional database usernames and passwords. This eliminates the need to store long-term database credentials within the application or a separate secrets management service. By assigning an IAM role with the necessary rds-db:connect permission to the application, you grant it temporary, short-lived credentials for database access, enhancing security and simplifying credential management. Storing credentials in AWS Secrets Manager or Systems Manager Parameter Store are valid ways to manage secrets securely, but they still involve retrieving and using traditional database credentials. Providing credentials as environment variables is insecure and not recommended for production environments.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed