Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is implementing a custom Lambda authorizer for Amazon API Gateway. The authorizer must validate incoming JSON Web Tokens (JWT) using a secret client key that is updated manually every six months. The API receives millions of requests daily, and the developer wants to minimize AWS service costs associated with secret retrieval while maintaining security. Which strategy should the developer use?

  1. Store the secret client key as a SecureString parameter in AWS Systems Manager Parameter Store. Retrieve the parameter outside the Lambda handler function to cache it, and enable caching on the API Gateway authorizer.Answer
  2. B
    Store the secret client key in AWS Secrets Manager. Retrieve the secret inside the Lambda handler function on every invocation using the AWS SDK.
  3. C
    Store the secret client key as an unencrypted environment variable in the Lambda function's configuration to avoid parameter retrieval overhead.
  4. D
    Store the secret client key as a String parameter in AWS Systems Manager Parameter Store. Retrieve the parameter inside the Lambda handler function on every invocation.

Answer

Store the secret client key as a SecureString parameter in AWS Systems Manager Parameter Store, retrieve it outside the Lambda handler for caching, and enable authorizer caching in API Gateway.
Storing the key as a SecureString in Systems Manager Parameter Store satisfies the security requirement by encrypting the secret at rest with AWS KMS. Since the key is rotated manually every six months, the automatic rotation features of Secrets Manager are not needed. Choosing Parameter Store is highly cost-effective because standard parameters do not incur API request fees. Furthermore, caching the secret outside the Lambda handler ensures it is reused across warm container invocations, and enabling authorizer caching in API Gateway prevents invoking the Lambda function for every incoming client request.

Step-by-Step Solution

1
Evaluate the encryption and rotation requirements for the secret client key.
The key must be stored securely with encryption, but it is rotated manually every six months rather than requiring automatic rotation.
This determines whether the advanced automatic rotation features of AWS Secrets Manager are required.
2
Evaluate the scale and cost implications of the AWS services under a high-volume request load.
Secrets Manager charges per API call, which is expensive at millions of requests per day. Systems Manager Parameter Store standard parameters provide SecureString encryption using AWS KMS keys without per-request charges.
This identifies Parameter Store as the most cost-effective option for manually rotated secrets at scale.
3
Optimize key retrieval performance and rate limiting.
Retrieve the Parameter Store value outside the Lambda handler to cache the value across execution contexts, and enable caching on the API Gateway authorizer.
This reduces latency, prevents API rate-limiting issues on Parameter Store, and minimizes Lambda executions.

Key Concept

Parameter Store vs Secrets Manager cost and features trade-offs
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic