DVA-C02 Question 190
Single answerYou are developing an AWS Lambda function that processes credit card transactions. To comply with security best practices, you need to securely store the API key required to interact with a third-party payment service. Which of the following is the BEST way to manage and access this sensitive data?
- A
Store the API key in the Lambda function's environment variables and encrypt it using AWS KMS.
- B
Hard-code the API key directly in the Lambda function code to ensure quick and easy access.
- C
Store the API key in AWS Secrets Manager and retrieve it at runtime using the AWS SDK.
- D
Store the API key in an S3 bucket with public-read access and access it during runtime.
Show answer and explanation
Correct answer: C
Explanation
AWS Secrets Manager is purpose-built for securely managing sensitive data like API keys, passwords, and other secrets. It integrates seamlessly with AWS services and provides runtime access to secrets via the AWS SDK. This approach ensures the sensitive data is not hard-coded, improperly stored, or exposed, aligning with security best practices.
- A. Incorrect.
While storing the API key in environment variables is common, encrypting it with AWS KMS requires additional manual management, such as decryption logic in the code. AWS Secrets Manager is specifically designed for securely managing secrets and is better suited for this use case.
- B. Incorrect.
Hard-coding sensitive data like an API key directly in the code is a security risk. It can lead to accidental exposure if the code is shared or stored in a version control system.
- C. Correct.
AWS Secrets Manager is the correct choice here as it is designed to securely store and manage sensitive data like API keys. It also provides features like automatic rotation and access logging.
- D. Incorrect.
Storing sensitive data in an S3 bucket with public-read access is highly insecure and exposes the data to unauthorized access. This is not a recommended practice.