DVA-C02 Question 202
Single answerYou are developing a serverless application using AWS Lambda. The Lambda function needs to connect to an Amazon RDS database, and you must securely pass the database connection details (e.g., username, password, host) to the Lambda function. Which of the following is the BEST way to achieve this while adhering to security best practices?
- A
Hardcode the database connection details directly in the Lambda function code.
- B
Use environment variables in the Lambda function to store the database connection details, and encrypt them using AWS Key Management Service (KMS) keys.
- C
Store the database connection details in an S3 bucket and allow the Lambda function to access the bucket.
- D
Use AWS Secrets Manager to store the database connection details and retrieve them from the Lambda function at runtime.
Show answer and explanation
Correct answer: D
Explanation
The best practice for managing sensitive data such as database connection details in an AWS Lambda function is to use AWS Secrets Manager. Secrets Manager allows you to securely store and retrieve sensitive information while providing features like automatic credential rotation and fine-grained access control. Although environment variables with encryption or S3 storage can be used, Secrets Manager is specifically designed for securely managing secrets and is the recommended approach for this scenario.
- A. Incorrect.
Hardcoding sensitive data like database connection details directly in the Lambda function code is not secure and violates security best practices. It also makes it difficult to rotate credentials.
- B. Incorrect.
While environment variables can be encrypted using AWS KMS keys, they are not the most secure option for managing sensitive data like database credentials. AWS Secrets Manager offers additional features like automatic credential rotation and fine-grained access control.
- C. Incorrect.
Storing sensitive data in an S3 bucket is not recommended unless the data is encrypted and access is tightly controlled. Even then, it is not as secure or convenient as using AWS Secrets Manager.
- D. Correct.
AWS Secrets Manager is the best option for storing and managing sensitive data such as database connection details. It provides features like automatic credential rotation, fine-grained permissions, and secure retrieval, making it the most secure and scalable solution.