DVA-C02 Question 295
Select 3Your company uses AWS AppConfig to manage feature flags and AWS Secrets Manager to store sensitive database credentials. You are developing a serverless application using AWS Lambda and need to ensure that your Lambda function retrieves the correct configuration and secret values during runtime. Which steps should you take to achieve this?
- A
Use the AWS SDK in your Lambda function to retrieve configuration data from AWS AppConfig.
- B
Create an IAM role for the Lambda function with permissions to access AWS AppConfig and Secrets Manager.
- C
Manually hardcode the secrets and configuration values in the Lambda function environment variables for faster access.
- D
Use the AWS SDK in your Lambda function to retrieve sensitive information from Secrets Manager.
- E
Enable AppConfig integration with Secrets Manager to automatically fetch secrets during AppConfig updates.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely access configurations and secrets in a Lambda function, you should use the AWS SDK to retrieve data from AWS AppConfig and Secrets Manager at runtime. The Lambda function needs an IAM role with the appropriate permissions to access these services. Hardcoding sensitive data is a poor practice as it can expose secrets and make updates more difficult. Additionally, AWS AppConfig and Secrets Manager require separate mechanisms for retrieving and managing data.
- A. Correct.
Correct: The AWS SDK allows your Lambda function to programmatically fetch configuration data from AWS AppConfig during runtime.
- B. Correct.
Correct: The Lambda function must have an IAM role granting it the necessary permissions to access AWS AppConfig and Secrets Manager resources securely.
- C. Incorrect.
Incorrect: Hardcoding secrets in Lambda environment variables is not recommended due to security risks and lack of flexibility.
- D. Correct.
Correct: The AWS SDK can also be used to fetch sensitive information from Secrets Manager, ensuring secure access to secrets during runtime.
- E. Incorrect.
Incorrect: AWS AppConfig does not natively integrate with Secrets Manager to automatically fetch secrets. You must use the AWS SDK or other mechanisms to retrieve secrets from Secrets Manager.