SCS-C02 Question 393
Select 3A company is building a serverless application on AWS that processes sensitive customer data. The application uses AWS Lambda functions, which require access to an Amazon RDS database and an external API. The database credentials and the external API key must not be hardcoded or exposed in the Lambda function code. Which combination of approaches should the company implement to securely manage and access these secrets?
- A
Store the database credentials and API key in AWS Secrets Manager, and retrieve them dynamically within the Lambda function at runtime.
- B
Encrypt the database credentials and API key using AWS KMS, and store the encrypted values in Lambda environment variables.
- C
Use IAM roles associated with the Lambda function to grant permissions to access AWS Secrets Manager and AWS KMS.
- D
Store the database credentials and API key in Amazon S3 with public-read access, and use pre-signed URLs to fetch them at runtime.
- E
Hardcode the database credentials and API key directly in the Lambda function code but restrict access to the Lambda function through IAM policies.
Show answer and explanation
Correct answers: A, B, C
Explanation
To securely manage credentials, secrets, and cryptographic key materials in AWS, it is essential to use AWS-native services like AWS Secrets Manager and AWS KMS. Secrets Manager allows for secure storage, access, and rotation of secrets, while KMS provides encryption capabilities. By leveraging IAM roles, Lambda functions can securely access these services without hardcoding credentials. Storing secrets in unsecured locations like S3 with public-read access or embedding them directly in code violates security best practices and exposes the organization to significant risks.
- A. Correct.
Storing the secrets in AWS Secrets Manager and retrieving them dynamically is a secure solution as Secrets Manager provides secret rotation and encryption at rest using AWS KMS.
- B. Correct.
Encrypting the secrets using AWS KMS and storing the encrypted values in Lambda environment variables adds an additional layer of security by ensuring the data is encrypted both at rest and in transit.
- C. Correct.
Using IAM roles associated with the Lambda function ensures that the function has permissions to securely access AWS Secrets Manager and AWS KMS without embedding any long-term credentials.
- D. Incorrect.
Storing secrets in Amazon S3 with public-read access is highly insecure and exposes sensitive data to the internet, making this option unsuitable for protecting credentials and secrets.
- E. Incorrect.
Hardcoding secrets in the Lambda function code is a poor security practice as it increases the risk of accidental exposure through code repositories or application logs.