DVA-C02 Question 191
Single answerYou are developing a serverless application using AWS Lambda, and your function needs to connect to an RDS database using credentials. How should you securely manage the database credentials to avoid hardcoding them in your application code?
- A
Store the database credentials in an environment variable and encrypt them using AWS KMS.
- B
Embed the database credentials directly in the Lambda function code but restrict access to the source code.
- C
Use AWS Secrets Manager to store and retrieve the database credentials securely.
- D
Store the database credentials in an S3 bucket with read-only permissions for the Lambda function.
Show answer and explanation
Correct answer: C
Explanation
The best practice for managing sensitive data like database credentials is to use AWS Secrets Manager. It is a purpose-built service that ensures credentials are securely stored, retrieved, and rotated. Hardcoding, storing in S3, or using environment variables, even with encryption, are less secure alternatives that do not align with AWS's recommended practices for sensitive data management.
- A. Incorrect.
Although encrypting credentials in environment variables with AWS KMS improves security, this approach still risks exposure since environment variables can be accessed at runtime if permissions are misconfigured. A more secure and centralized solution is better suited.
- B. Incorrect.
Embedding credentials directly in the Lambda function code increases the risk of exposure, especially if the code is checked into version control or shared inadvertently.
- C. Correct.
AWS Secrets Manager is specifically designed to securely manage and retrieve sensitive information like database credentials. It provides fine-grained access control, automatic rotation, and integration with AWS services like Lambda.
- D. Incorrect.
Storing credentials in an S3 bucket, even with read-only permissions, is not recommended because it introduces potential security vulnerabilities and lacks the sophisticated credential management features of AWS Secrets Manager.