A Lambda function reads a database password from a plaintext environment variable. The team wants the secret removed from configuration, rotated regularly, and fetched at runtime. What should they use?
Show answer and explanation
Answer: B
AWS Secrets Manager stores the secret encrypted with KMS, controls access through IAM policies, records retrieval in CloudTrail, and supports rotation. The function's execution role grants permission to call GetSecretValue, so the code fetches the current value at runtime. The password never appears in source control or in the function's configuration.
Why the other options are wrong
- A. A password in a repository is exposed to everyone with read access and persists in history even after deletion. This is the pattern the team is trying to eliminate.
- C. A longer password is still stored in plaintext configuration that anyone with configuration-read permissions can see. It also cannot be rotated automatically by the platform.
- D. A publicly readable object exposes the password to anyone on the internet. It is the least secure of the options listed.