Examkin

Question

Difficulty: MediumServerless Development with AWS Lambda

A company is deploying a serverless microservice that requires access to an Amazon RDS database. The database credentials must be rotated every 30 days. The design requires that the microservice retrieves these credentials securely, minimizes latency during invocations, and minimizes Secrets Manager API call costs. Which two actions should be taken to meet these requirements? (Select two.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation.Answer
  2. Retrieve and cache the credentials in a global variable outside of the Lambda handler function to reuse them across subsequent warm invocations.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a Standard String parameter and enable native scheduled parameter rotation.
  4. D
    Call the Secrets Manager API to retrieve the credentials at the beginning of the handler function on every invocation to guarantee the most up-to-date credentials.
  5. E
    Hardcode the database credentials directly within the Lambda function code and restrict access to the Lambda console using an IAM trust policy.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation, and retrieve and cache the credentials in a global variable outside of the Lambda handler function.
Storing the credentials in AWS Secrets Manager allows native integration with Amazon RDS for automated rotation. Retrieving the secret outside the handler function allows the Lambda execution context to cache the credentials in memory, meaning subsequent invocations (warm starts) do not need to make costly and high-latency API calls to Secrets Manager.

Step-by-Step Solution

1
Store the database credentials securely in AWS Secrets Manager, which natively supports automatic rotation for Amazon RDS databases using a Lambda rotation helper.
Secrets are encrypted at rest and can be rotated automatically without application downtime.
This fulfills the requirement of secure storage and automatic rotation.
2
In the Lambda function code, write the API call to retrieve the secret outside of the handler function, storing the result in a global or static variable.
The secret is fetched once during the function's cold start (initialization phase) and remains in memory for subsequent warm invocations.
This minimizes the number of API calls to Secrets Manager, lowering costs and reducing latency by reusing the execution context.

Key Concept

AWS Lambda execution context reuse can be leveraged to cache static configuration and credentials retrieved from AWS Secrets Manager, optimizing performance and reducing external API call costs.
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic