DVA-C02 Question 203
Single answerYou are developing a serverless application using AWS Lambda, and your function requires access to a database. The database credentials must not be hardcoded in the Lambda function's code. Which is the MOST appropriate way to securely provide the database credentials to the Lambda function?
- A
Use environment variables in the Lambda function configuration to store the database credentials.
- B
Hardcode the database credentials directly in the Lambda function's source code.
- C
Use AWS Secrets Manager to store the database credentials and retrieve them within the Lambda function.
- D
Store the database credentials in an S3 bucket and use the Lambda function to download them at runtime.
Show answer and explanation
Correct answer: C
Explanation
Using AWS Secrets Manager is the most secure and recommended approach for managing sensitive information like database credentials in AWS Lambda. While environment variables can be used, they are not the most secure option. Hardcoding credentials in the source code or storing them in an S3 bucket poses significant security risks. AWS Secrets Manager provides a secure way to store, rotate, and access secrets, making it the ideal choice for this scenario.
- A. Incorrect.
Environment variables are commonly used to store configuration data, but they are not the most secure way to manage sensitive information like database credentials. Encrypting the variables with KMS can add security, but AWS Secrets Manager is still better suited for managing sensitive secrets.
- B. Incorrect.
Hardcoding sensitive information, such as database credentials, directly in the source code is a poor security practice and should be avoided. This approach increases the risk of accidental exposure, especially in shared repositories.
- C. Correct.
AWS Secrets Manager is specifically designed to securely store and manage sensitive information, such as database credentials. You can retrieve the credentials at runtime using the AWS SDK, ensuring they are securely managed and rotated as needed.
- D. Incorrect.
Storing sensitive credentials in an S3 bucket is not a secure approach, even if the bucket is private. If the bucket's permissions are misconfigured or compromised, the credentials could be exposed.