Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is building a backend application on AWS Lambda that integrates with a third-party payment gateway. The integration requires an API key that is rotated automatically every 30 days. The developer needs to store the API key securely, automate its rotation, and retrieve it in the Lambda function with minimal latency. Which storage and management approach should the developer use to meet these requirements with the least operational effort?

  1. Store the API key in AWS Secrets Manager. Configure automated rotation in AWS Secrets Manager by writing a custom AWS Lambda rotation function, and retrieve the key in the backend Lambda function using the AWS SDK with local caching.Answer
  2. B
    Store the API key in Systems Manager Parameter Store as a SecureString parameter. Enable the built-in Parameter Store lifecycle policy to automatically rotate the parameter every 30 days.
  3. C
    Store the API key in Systems Manager Parameter Store as a SecureString parameter. Configure an Amazon EventBridge scheduler to trigger a custom AWS Lambda function every 30 days to generate and update the Parameter Store parameter.
  4. D
    Hardcode the API key directly within the backend Lambda function's handler code and use AWS CodePipeline to automatically rebuild and redeploy the function when the key is updated by the payment gateway.

Answer

Store the API key in AWS Secrets Manager, configure automated rotation using a custom Lambda function, and retrieve the key in the backend Lambda function using the AWS SDK with local caching.
Storing the API key in AWS Secrets Manager and configuring a custom Lambda rotation function allows AWS to natively manage the rotation schedule and execution. The application Lambda function retrieves the key at runtime using the AWS SDK, and caching it locally ensures subsequent invocations do not call Secrets Manager unnecessarily, minimizing latency and API costs.

Step-by-Step Solution

1
Create a secret in AWS Secrets Manager to store the third-party payment gateway API key.
The API key is securely encrypted and stored.
AWS Secrets Manager is optimized for securing credentials and sensitive values.
2
Configure AWS Secrets Manager rotation settings by linking a custom AWS Lambda rotation function and setting the schedule to 30 days.
Secrets Manager automatically invokes the Lambda function on schedule to update the secret value.
This automates the rotation lifecycle with native orchestrations instead of custom cron schedulers.
3
Update the application Lambda function to retrieve the API key using the AWS SDK and cache the value in memory.
The key is fetched at startup or initialization and reused across invocations, lowering latency and reducing cost.
Local caching minimizes the number of API calls to AWS Secrets Manager.

Key Concept

Automating secret rotation using AWS Secrets Manager vs manual orchestration or insecure alternatives.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic