DVA-C02 Question 116
Select 3You are developing a serverless application using AWS Lambda, and you need to ensure that your Lambda function can securely access a database hosted on Amazon RDS. The database credentials are stored in AWS Secrets Manager. Which steps should you take to ensure secure access to the database?
- A
Attach a policy to the Lambda execution role that grants permission to retrieve the secret from AWS Secrets Manager.
- B
Hardcode the database credentials in the Lambda function's environment variables for quick access.
- C
Use the AWS SDK in your Lambda function to retrieve the secret from Secrets Manager at runtime.
- D
Encrypt the database credentials using AWS KMS and store them in an S3 bucket, then retrieve and decrypt them in the Lambda function.
- E
Ensure the Lambda execution role is associated with a VPC that has network access to the RDS database.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely access the RDS database, the Lambda execution role must have the appropriate permission to access Secrets Manager (Option 1), and the AWS SDK can be used to retrieve the credentials dynamically (Option 3). Additionally, the Lambda function must have network access to the RDS database, which may require being associated with a VPC (Option 5). Hardcoding credentials (Option 2) and manually encrypting/storing credentials in S3 (Option 4) are not secure or efficient approaches.
- A. Correct.
Correct: The Lambda execution role must have the necessary permissions to access the secret stored in AWS Secrets Manager.
- B. Incorrect.
Incorrect: Hardcoding credentials in the Lambda function's environment variables is not secure and violates AWS best practices.
- C. Correct.
Correct: Using the AWS SDK to retrieve secrets from Secrets Manager at runtime ensures secure and dynamic access to the credentials.
- D. Incorrect.
Incorrect: Encrypting credentials manually and storing them in S3 introduces unnecessary complexity and security risks compared to using AWS Secrets Manager.
- E. Correct.
Correct: The Lambda function must be able to connect to the RDS database, which may require being associated with a VPC that has proper network access.