You plan to manage API keys in AWS Secrets Manager. The keys need to be automatically rotated to be compliant with the company policy. From Secrets Manager, applications can get the latest version of the API credentials. How would you implement the rotation of keys?

Answer options:

A.Use AWS Parameter Store to store and rotate the keys as Secrets Manager does not support it.
B.Directly add multiple keys in Secrets Manager for rotation and the keys will be rotated every year automatically.
C.Customize the Lambda function that performs the rotation of secrets in Secrets Manager.
D.Create two secrets in Secrets Manager to store two versions of the API credentials. Modify the application to get one of them.

Correct Answer – C
Option A is incorrect because Secrets Manager supports the key rotation for database credentials, third-party services, etc.
Option B is incorrect because Secrets Manager natively knows how to rotate secrets for supported databases such as RDS. For other secret types, such as API keys, users need to customize the Lambda rotation function.
Option C is CORRECT because, for API keys, users must provide the code for the Lambda function that rotates the secrets.
Option D is incorrect because only one secret in Secrets Manager is required, and the application should always get the latest version of the secret.
Reference:
https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html.
https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-lambda-function-customizing.html.