SAP-C02 Question 244
Single answerYou are designing a serverless application that processes sensitive customer data. The application is built using AWS Lambda and requires access to an Amazon S3 bucket and an Amazon DynamoDB table. To ensure secure and automated credential management, which of the following approaches should you use?
- A
Manually create and embed long-term AWS credentials in the Lambda function's environment variables.
- B
Assign an IAM role to the Lambda function with appropriate permissions for accessing S3 and DynamoDB.
- C
Store the AWS credentials in Secrets Manager and retrieve them programmatically within the Lambda function.
- D
Use an EC2 instance profile for credential management and configure the Lambda function to assume the EC2 role.
Show answer and explanation
Correct answer: B
Explanation
The best practice for securely managing credentials in AWS is to use IAM roles. AWS Lambda can assume an assigned IAM role, and AWS automatically provides temporary credentials for the role. This removes the need to manage credentials manually while ensuring secure access to AWS resources like S3 and DynamoDB.
- A. Incorrect.
Embedding long-term AWS credentials in environment variables is not a secure practice and increases the risk of credential exposure.
- B. Correct.
Assigning an IAM role to the Lambda function is the recommended approach as it allows AWS to securely manage temporary credentials for the function.
- C. Incorrect.
While AWS Secrets Manager is useful for managing application secrets, it is not intended for managing AWS credentials. Additionally, retrieving credentials programmatically adds unnecessary complexity.
- D. Incorrect.
EC2 instance profiles are designed for EC2 instances, not Lambda functions. Using an instance profile in this context is not feasible or secure.