DVA-C02 Question 292
Select 2You are developing a serverless application on AWS that requires dynamic application configurations and secure database credentials. The application runs on AWS Lambda. The configurations need to be updated without redeploying the function, and sensitive data such as database credentials must remain encrypted during retrieval. Which of the following is the optimal way to achieve this?
- A
Use AWS AppConfig to store dynamic configurations and AWS Secrets Manager to retrieve database credentials.
- B
Hardcode the application configurations and database credentials in the Lambda function code.
- C
Use AWS Systems Manager Parameter Store for both dynamic configurations and database credentials.
- D
Use an Amazon S3 bucket to store configurations and database credentials in plain text.
- E
Use AWS AppConfig to store dynamic configurations and retrieve database credentials from AWS Secrets Manager using the SDK.
Show answer and explanation
Correct answers: A, E
Explanation
AWS AppConfig is purpose-built for managing and deploying dynamic application configurations without redeploying code, making it a perfect fit for serverless applications. AWS Secrets Manager is designed for securely storing and retrieving sensitive information such as database credentials, with features like encryption and automatic rotation. Together, they provide a secure and scalable solution for managing application configurations and sensitive data.
- A. Correct.
Correct. AWS AppConfig is designed to manage dynamic application configurations, and AWS Secrets Manager is ideal for securely storing and retrieving sensitive data like database credentials.
- B. Incorrect.
Incorrect. Hardcoding configurations and credentials violates best practices as it makes updates difficult and exposes sensitive data to security risks.
- C. Incorrect.
Incorrect. While AWS Systems Manager Parameter Store can handle configurations and credentials, it does not offer the same level of purpose-built features for dynamic configurations as AWS AppConfig or the automated rotation of secrets provided by AWS Secrets Manager.
- D. Incorrect.
Incorrect. Storing sensitive data in plain text in an S3 bucket is a significant security risk and does not align with AWS best practices for secure storage of credentials.
- E. Correct.
Correct. Using AWS AppConfig for dynamic configurations and AWS Secrets Manager for database credentials ensures secure and scalable management of both configurations and sensitive data.