AWS Certified Developer Associate · Free Practice Question Medium
Question 39
An AWS Lambda function requires several environment variables with secret values. The secret values should be obscured in the Lambda console and API output even for users who have permission to use the key.
What is the best way to achieve this outcome and MINIMIZE complexity and latency?
-
A
Store the encrypted values in an encrypted Amazon S3 bucket and reference them from within the code
-
B
Use an external encryption infrastructure to encrypt the values and add them as environment variables
-
C
Encrypt the secret values client-side using encryption helpers
-
D
Encrypt the secret values with a customer-managed CMK
Reveal correct answer
Correct answer: C
Explanation
You can use environment variables to store secrets securely for use with Lambda functions. Lambda always encrypts environment variables at rest.
Additionally, you can use the following features to customize how environment variables are encrypted.
• Key configuration – On a per-function basis, you can configure Lambda to use an encryption key that you create and manage in AWS Key Management Service. These are referred to as customer managed customer master keys (CMKs) or customer managed keys. If you don't configure a customer managed key, Lambda uses an AWS managed CMK named aws/lambda, which Lambda creates in your account.
• Encryption helpers – The Lambda console lets you encrypt environment variable values client side, before sending them to Lambda. This enhances security further by preventing secrets from being displayed unencrypted in the Lambda console, or in function configuration that's returned by the Lambda API. The console also provides sample code that you can adapt to decrypt the values in your function handler.
The configuration for using encryption helps to encrypt data client-side looks like this:
This is the best way to achieve this outcome and minimizes complexity as the encryption infrastructure will still use AWS KMS and be able to decrypt the values during function execution.
CORRECT: "Encrypt the secret values client-side using encryption helpers" is the correct answer.
INCORRECT: "Encrypt the secret values with a customer-managed CMK" is incorrect as this alone will not achieve the desired outcome as the environment variables should be encrypted client-side with the encryption helper to ensure users cannot see the secret values.
INCORRECT: "Store the encrypted values in an encrypted Amazon S3 bucket and reference them from within the code" is incorrect as this would introduce complexity and latency.
INCORRECT: "Use an external encryption infrastructure to encrypt the values and add them as environment variables" is incorrect as this would introduce complexity and latency.
References:
https://docs.aws.amazon.com/lambda/latest/dg/security-dataprotection.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
