DVA-C02 Question 69
Single answerYou are developing a serverless application using AWS Lambda. Your function needs to access sensitive database credentials stored securely. According to best practices, how should you configure your Lambda function to retrieve these credentials securely?
- A
Store the database credentials directly in the Lambda function's environment variables.
- B
Use AWS Secrets Manager to store the credentials and retrieve them at runtime using the AWS SDK.
- C
Hardcode the database credentials in the Lambda function's source code.
- D
Store the database credentials in an Amazon S3 bucket with public read access and fetch them at runtime.
Show answer and explanation
Correct answer: B
Explanation
The correct approach to securely manage sensitive credentials for a Lambda function is to use AWS Secrets Manager. Secrets Manager is specifically designed for this purpose, offering secure storage, rotation, and controlled access to secrets such as database credentials. This ensures that your application remains secure and follows AWS best practices.
- A. Incorrect.
Storing sensitive data, such as database credentials, directly in environment variables is not recommended as it can expose those credentials if environment variables are not properly secured.
- B. Correct.
Using AWS Secrets Manager to store sensitive data like database credentials is a best practice. Secrets Manager provides secure storage, rotation, and fine-grained access control, ensuring credentials are accessed securely at runtime.
- C. Incorrect.
Hardcoding sensitive credentials in the source code is a bad security practice, as it can lead to accidental exposure if the code is shared or stored in a public repository.
- D. Incorrect.
Storing sensitive credentials in an Amazon S3 bucket with public read access poses a severe security risk. Anyone with access to the bucket can retrieve the credentials.