Examkin

Question

Difficulty: HardServerless Development with AWS Lambda

A developer is designing a serverless application that integrates with a third-party billing API. The application uses an AWS Lambda function to send requests. The API key for the billing provider is stored in AWS Secrets Manager and is automatically rotated every 1212 hours. During initial load testing, retrieving the key from Secrets Manager on every function invocation significantly increases the execution latency and Secrets Manager API costs. The developer wants to optimize the retrieval process while ensuring the function always uses a valid, unexpired API key. Which approach meets these requirements with the lowest latency and cost?

  1. A
    Retrieve the API key from Secrets Manager in the initialization code outside the handler and store it in a global variable, relying on Lambda to automatically re-run the initialization phase when the secret is rotated in Secrets Manager.
  2. B
    Deploy the Lambda function inside a private subnet of a custom VPC without a NAT gateway or VPC endpoint, and retrieve the API key from Secrets Manager inside the handler function on every invocation using the AWS SDK.
  3. Configure the AWS Parameters and Secrets Lambda Extension in the Lambda function, and retrieve the API key via a local HTTP request with a time-to-live (TTL) of 300300 seconds.Answer
  4. D
    Configure the API key as a secure string parameter in Systems Manager Parameter Store, and write custom logic in the Lambda handler to fetch the parameter using hardcoded IAM access keys to bypass runtime credential checks.

Answer

Configure the AWS Parameters and Secrets Lambda Extension in the Lambda function, and retrieve the API key via a local HTTP request with a time-to-live (TTL) of 300300 seconds.
The correct approach is to configure the AWS Parameters and Secrets Lambda Extension. This extension runs alongside the Lambda function container and caches secrets locally, exposing a localhost endpoint. When the handler queries the local HTTP endpoint, the extension returns the cached key. If the key has expired based on the configured Time-to-Live (TTL), the extension calls AWS Secrets Manager to retrieve the new key. A short TTL like 300300 seconds ensures that when the key is rotated every 1212 hours, the cached value is refreshed within minutes, preventing authentication failures while still providing low latency and low Secrets Manager API costs.

Step-by-Step Solution

1
Enable the AWS Parameters and Secrets Lambda Extension by adding its layer to the Lambda function configuration.
The extension runs in a separate process within the Lambda execution environment, exposing a local HTTP server at localhost.
This allows the Lambda function to make fast, in-memory HTTP calls to retrieve configuration values and secrets instead of making external SDK requests on every invocation.
2
Configure environment variables for the extension, such as SECRETS_MANAGER_TTL, or specify a TTL of 300300 seconds in the local HTTP headers when making the request.
The extension caches the secret for the specified duration (300300 seconds) before fetching it again from the Secrets Manager service.
By setting a TTL that is significantly shorter than the 1212-hour rotation window, we ensure that the key is refreshed regularly and does not become stale, while still caching it to optimize latency and minimize costs.
3
Update the Lambda function's handler code to make a local GET request to the extension's localhost port to retrieve the API key.
The Lambda function receives the API key with sub-millisecond local latency on cache hits.
This avoids the overhead of invoking the full Secrets Manager API via the AWS SDK during every execution, which reduces costs and transaction latency.

Key Concept

Caching secrets using the AWS Parameters and Secrets Lambda Extension is the recommended best practice for optimizing performance and cost when Lambda functions consume secrets that undergo periodic rotation.
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic