AWS Certified Solutions Architect – Associate (SAA-C03)Design Secure ArchitecturesMedium
A media company is building a serverless application using AWS Lambda functions and Amazon DynamoDB. The Lambda functions need to access sensitive configuration parameters, such as API keys and database credentials, without hardcoding them into the function code or exposing them in environment variables. The solution must provide secure storage, automatic rotation, and integration with Lambda's execution environment. Which AWS service should they use?
- AAmazon S3
- BAWS Secrets Manager
- CAWS Systems Manager Parameter Store
- DAWS Key Management Service (KMS)
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Secrets Manager
AWS Secrets Manager is specifically designed for securely storing and managing secrets like database credentials and API keys. It offers automatic rotation, fine-grained access control, and easy integration with Lambda functions, allowing them to retrieve secrets at runtime without hardcoding them. This meets all specified requirements.
Why the other options are wrong
- A. Storing sensitive data in S3 is not recommended for secrets due to lack of native rotation and secure retrieval mechanisms suitable for application credentials.
- C. Parameter Store can store sensitive data encrypted, but it lacks the built-in automatic rotation capabilities specifically designed for secrets like database credentials.
- D. KMS is for managing encryption keys, not for storing the secrets themselves. Secrets Manager uses KMS for encryption but is the service for secret management.
AWS Secrets Manager
A service that helps you protect access to your applications, services, and IT resources by enabling you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.
- Securely stores and retrieves secrets.
- Offers automatic rotation of secrets.
- Integrates with AWS services like Lambda and RDS.
- Provides granular access control via IAM.
Memory trick: Secrets Manager: The 'S'afe 'M'anager for 'S'ensitive 'S'tuff.