DVA-C02 Question 205
Single answerYou are developing a serverless application on AWS that requires database credentials to connect to an Amazon RDS instance. The application is deployed using AWS Lambda. To securely manage the database credentials and rotate them automatically, which solution should you implement?
- A
Store the database credentials in AWS Secrets Manager and configure the Lambda function to retrieve them at runtime.
- B
Embed the database credentials directly in the Lambda function's environment variables.
- C
Use AWS Systems Manager Parameter Store with an encrypted parameter to store the database credentials and retrieve them at runtime.
- D
Store the database credentials in an S3 bucket and grant the Lambda function access to the bucket.
Show answer and explanation
Correct answer: A
Explanation
The best practice for managing secrets like database credentials in AWS is to use AWS Secrets Manager. It is specifically designed for securely storing and managing secrets, supports automatic rotation, and integrates seamlessly with AWS Lambda. While AWS Systems Manager Parameter Store is an alternative for securely storing secrets, it does not offer the automatic rotation feature required in this scenario, making AWS Secrets Manager the more suitable choice.
- A. Correct.
This is the correct answer. AWS Secrets Manager is designed for securely managing secrets like database credentials, API keys, and tokens. It also supports automatic rotation of secrets and can be easily accessed by AWS Lambda at runtime using the AWS SDK or environment variables.
- B. Incorrect.
This is not a secure practice. Embedding credentials directly in the Lambda function's environment variables increases the risk of accidental exposure and does not support automatic rotation.
- C. Incorrect.
While AWS Systems Manager Parameter Store can securely store credentials using encrypted parameters, it does not natively provide automatic rotation of secrets, which is a crucial requirement in this scenario.
- D. Incorrect.
Storing credentials in an S3 bucket, even if encrypted, is not a recommended practice for secrets management. S3 is not designed for managing sensitive credentials and lacks features like automatic rotation.