DVA-C02 Question 294
Select 3You are developing a serverless application in AWS Lambda that requires access to runtime configurations and sensitive database credentials. To adhere to best practices, you decide to use AWS AppConfig for application configurations and AWS Secrets Manager for managing sensitive credentials. How can you securely retrieve these values at runtime?
- A
Use the AWS SDK within your Lambda function to fetch configuration values from AWS AppConfig and secrets from AWS Secrets Manager.
- B
Embed the database credentials and configuration values directly in the Lambda function code.
- C
Use environment variables in the Lambda function to store sensitive credentials and configuration values.
- D
Attach an IAM role to the Lambda function with permissions to access AWS AppConfig and Secrets Manager.
- E
Use AppConfig's configuration profiles and Secrets Manager's secret rotation feature to ensure that values are dynamically updated and securely accessed.
Show answer and explanation
Correct answers: A, D, E
Explanation
To securely retrieve runtime configurations and sensitive credentials in a Lambda function, you should use the AWS SDK to fetch values dynamically from AWS AppConfig and Secrets Manager. Additionally, attaching an IAM role with appropriate permissions to the Lambda function ensures secure access without hardcoding credentials. Using AppConfig's configuration profiles and Secrets Manager's rotation feature enhances security and ensures that configuration values and secrets are dynamically updated as needed.
- A. Correct.
Correct: AWS SDK can be used to programmatically retrieve values from AWS AppConfig and AWS Secrets Manager, ensuring secure and dynamic access at runtime.
- B. Incorrect.
Incorrect: Embedding sensitive information directly in the code violates security best practices and makes the application vulnerable to credential exposure.
- C. Incorrect.
Incorrect: While environment variables can be used, storing sensitive credentials in plain text as environment variables is not secure and is not recommended.
- D. Correct.
Correct: Attaching an IAM role to the Lambda function with the necessary permissions ensures secure access to AWS AppConfig and Secrets Manager without hardcoding credentials.
- E. Correct.
Correct: AppConfig's configuration profiles allow dynamic retrieval of configuration values, and Secrets Manager's rotation feature ensures secrets are updated securely and automatically.