SAP-C02 Question 418
Single answerA company is building a serverless application that uses AWS Lambda functions to process sensitive customer information. The security team requires that sensitive data such as API keys and database credentials should not be stored in the Lambda function code or environment variables. Additionally, the solution should automatically rotate these secrets without requiring code changes in the application. Which solution meets these requirements?
- A
Store the secrets in AWS Secrets Manager, retrieve them dynamically within the Lambda function, and enable automatic secret rotation.
- B
Encrypt the secrets using AWS Key Management Service (KMS) and store them in a secure S3 bucket, then retrieve them using the Lambda function.
- C
Use AWS Systems Manager Parameter Store to store the secrets as plaintext parameters and retrieve them dynamically within the Lambda function.
- D
Hardcode the secrets in the Lambda function code and ensure they are encrypted using KMS before being deployed.
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is the best choice for this scenario because it provides a secure and managed way to store and retrieve sensitive information like API keys and database credentials. It integrates natively with AWS Lambda and supports automatic secret rotation, which ensures that security requirements are met without requiring updates to the application code. Other options either lack automatic rotation, do not integrate seamlessly with Lambda, or violate best practices.
- A. Correct.
Correct: AWS Secrets Manager provides a fully managed solution for storing, encrypting, and rotating secrets such as API keys and database credentials. It integrates seamlessly with AWS Lambda, enabling secrets to be retrieved dynamically during execution. Enabling automatic rotation ensures that secrets are updated without requiring code changes.
- B. Incorrect.
Incorrect: While encrypting secrets with KMS and storing them in S3 can secure the data, this approach does not provide automatic secret rotation or native integration with AWS Lambda, which fails to meet the requirements.
- C. Incorrect.
Incorrect: AWS Systems Manager Parameter Store can store and retrieve secrets, but without using the advanced tier, it does not support automatic secret rotation. This option does not fully meet the requirement for automatic rotation.
- D. Incorrect.
Incorrect: Hardcoding secrets, even if encrypted, is a poor security practice and does not allow for automatic rotation. This approach violates AWS security best practices.