DVA-C02 Question 189
Single answerYou are building a serverless application on AWS, and the application requires access to an external API. The API key for accessing this external API is sensitive data that should not be hardcoded in your application code. Which approach should you use to securely manage and access the API key?
- A
Store the API key in an S3 bucket with public read access and retrieve it from the application at runtime.
- B
Store the API key as an environment variable in AWS Lambda and restrict access using IAM policies.
- C
Encrypt the API key using AWS KMS and store it in your application code in an encrypted format.
- D
Store the API key in AWS Secrets Manager and retrieve it securely at runtime.
Show answer and explanation
Correct answer: D
Explanation
The most secure way to manage sensitive data such as an API key is by using AWS Secrets Manager. Secrets Manager allows you to store, encrypt, and manage secrets securely. It integrates with IAM for fine-grained access control and enables secure retrieval of the API key at runtime, minimizing the risk of exposure.
- A. Incorrect.
Storing sensitive data like an API key in an S3 bucket with public read access is highly insecure. This would expose the API key to unauthorized access.
- B. Incorrect.
While storing the API key as an environment variable in AWS Lambda is a common practice, it is not the most secure option. Environment variables can still be accessed by unauthorized users if the IAM policies are misconfigured.
- C. Incorrect.
Encrypting the API key with AWS KMS and storing it in the application code is better than plaintext storage but still poses a security risk. If the application code is compromised, the encrypted key and decryption logic might also be exposed.
- D. Correct.
AWS Secrets Manager is specifically designed to manage sensitive data like API keys securely. It allows controlled access using IAM policies and provides encryption at rest and secure retrieval at runtime.