SAP-C02 Question 417
Single answerA company is building a serverless application that processes sensitive customer data. The application consists of AWS Lambda functions that need access to database credentials stored securely. The company wants to ensure that these credentials are rotated automatically and are only accessible to the Lambda functions that require them. Which solution should the Solutions Architect implement to meet these requirements?
- A
Store the database credentials in AWS Systems Manager Parameter Store with a SecureString type and grant the Lambda functions permissions to access them.
- B
Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.
- C
Embed the database credentials directly into the Lambda function's environment variables for faster access.
- D
Store the database credentials in an encrypted Amazon S3 bucket and use AWS Key Management Service (AWS KMS) to control access.
Show answer and explanation
Correct answer: B
Explanation
AWS Secrets Manager is the optimal solution for managing sensitive secrets like database credentials. It provides built-in capabilities for securely storing secrets, automatic rotation, and fine-grained access control using IAM policies. By leveraging AWS Secrets Manager, the company ensures that credentials are securely managed and meet the requirements for automatic rotation and restricted access.
- A. Incorrect.
AWS Systems Manager Parameter Store can store sensitive data as SecureString, but it does not natively support automatic rotation of secrets. Therefore, this option does not fully meet the requirement for automatic rotation.
- B. Correct.
AWS Secrets Manager is purpose-built for secrets management. It allows you to store credentials securely, configure automatic rotation, and control access to the secrets using IAM policies. This solution meets all the requirements.
- C. Incorrect.
Embedding sensitive credentials directly into Lambda environment variables is not a secure practice. This approach exposes secrets to potential compromise and does not provide automatic rotation.
- D. Incorrect.
Storing sensitive data in an encrypted S3 bucket is possible, but it does not provide built-in secret rotation or fine-grained access control tailored for secrets management. This makes it less suitable for the scenario.