DVA-C02 Question 4
Single answerYou are developing a serverless application using AWS Lambda, and you need to securely retrieve database credentials stored in AWS Secrets Manager. The Lambda function should only have access to the specific secret it needs. How can you configure this setup?
- A
Attach an IAM policy to the Lambda function's execution role, allowing it to retrieve any secret in AWS Secrets Manager.
- B
Create an IAM policy that grants access only to the specific secret ARN in Secrets Manager and attach it to the Lambda function's execution role.
- C
Embed the database credentials directly into the Lambda function code for quick access.
- D
Use environment variables to store the database credentials in plaintext and reference them in the Lambda function code.
Show answer and explanation
Correct answer: B
Explanation
The best practice for securely accessing secrets in AWS is to use AWS Secrets Manager with fine-grained IAM permissions. By creating an IAM policy that grants access only to the specific secret ARN and attaching it to the Lambda function's execution role, you ensure that the Lambda function has the necessary access while adhering to the principle of least privilege. This reduces the risk of unauthorized access to sensitive credentials.
- A. Incorrect.
Granting access to all secrets in Secrets Manager is overly permissive and violates the principle of least privilege. This option is not secure.
- B. Correct.
This approach follows the principle of least privilege by granting access only to the specific secret ARN that the Lambda function needs. It is the best practice for securing sensitive information.
- C. Incorrect.
Embedding database credentials directly into the Lambda function code is not a secure practice. If the code is compromised, the credentials could be exposed.
- D. Incorrect.
Storing database credentials in plaintext as environment variables is a security risk, as they can be easily accessed if the environment variables are exposed.