Answer: A Parameter store can store DB credentials as secure string but CANNOT rotate secrets, hence, go with A + Cannot enable encryption on existing MySQL RDS instance, must create a new encrypted one from unencrypted snapshot.

A https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html

A for sure.

My first answer was A

B and C are wrong because of RDS encryption limitation https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html#Overview.Encryption.Limitations D is incorrect due to parameter store usage. There's no rotation provided by the service

Ans: A

A is correct

A is the right answer

Here is why D cannot be correct: https://aws.amazon.com/premiumsupport/knowledge-center/rds-encrypt-instance-mysql-mariadb/ In the short description of this link - it specifically states that you cannot create an encrypted read-replica from an unencrypted DB. The only way to set encryption on an RDS instance is during deployment of the initial instance or creating a new instance from a snapshot and selecting the Encryption and Key in the parameters page. So that eliminates B,C,D. D is also incorrect since you would not need to create another Lambda function to rotate the keys - this is a feature included in Secrets Manager OOTB.

Answer: A Encrypting a unencrypted instance of DB or creating a encrypted replica of an un encrypted DB instance are not possible Hence A is the only solution possible. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html#Overview.Encryption.Limitations

A is correct

지금 사용중

A. Configure the Lambda function to store and retrieve the database credentials in AWS Secrets Manager and enable rotation of the credentials. Take a snapshot of the DB instance and encrypt a copy of that snapshot. Replace the DB instance with a new DB instance that is based on the encrypted snapshot.

RDS has integration with Secret Manger with Key rotation fuction.

Answer is A. Secret manager will store and rotate secrets. And need encrypted snapshot to create encryption at rest DB.

AAAAAAAAAAAAAAAAA

Option A is correct. Because you can't create an encrypted read replica from an unencrypted instance. https://aws.amazon.com/premiumsupport/knowledge-center/rds-encrypt-instance-mysql-mariadb