DVA-C02 Question 204
Select 2You are developing a serverless application using AWS Lambda. The Lambda function needs to connect to a database, and the database credentials must not be hardcoded in the function code for security reasons. Which of the following approaches can securely provide the Lambda function with the database credentials?
- A
Store the database credentials as environment variables in the Lambda function configuration and encrypt them using AWS Key Management Service (KMS).
- B
Include the database credentials directly in the Lambda function's code and obfuscate the values using base64 encoding.
- C
Use AWS Secrets Manager to store the database credentials and access them programmatically within the Lambda function.
- D
Pass the database credentials to the Lambda function via the event payload every time the function is invoked.
- E
Store the database credentials in an Amazon S3 bucket and restrict access to the bucket using an IAM policy.
Show answer and explanation
Correct answers: A, C
Explanation
To securely provide sensitive information like database credentials to an AWS Lambda function, you should either use environment variables with KMS encryption or AWS Secrets Manager. Both methods ensure credentials are securely stored and only accessible to authorized entities. Hardcoding, using insecure encoding methods, or relying on less secure storage systems like S3 are not recommended practices.
- A. Correct.
This is a valid approach. Storing credentials as environment variables and encrypting them with AWS KMS ensures the credentials are securely stored and only accessible to authorized users or services.
- B. Incorrect.
This is not a secure approach. Simply obfuscating credentials using base64 encoding does not provide true security, as encoding can easily be reversed.
- C. Correct.
This is a valid approach. AWS Secrets Manager is specifically designed for storing and managing sensitive information like database credentials securely. The Lambda function can retrieve these credentials programmatically at runtime.
- D. Incorrect.
Passing sensitive information like database credentials through the event payload is not secure, as it could expose the credentials in logs or to unauthorized users.
- E. Incorrect.
Storing sensitive credentials in an Amazon S3 bucket is not recommended, even with IAM restrictions, as it is less secure compared to services like AWS Secrets Manager or Lambda environment variables with KMS encryption.