Q29 — AWS SAA-C03 Ch.12

Question 29 of 100 | ← Chapter 12

Q829. A company has AWS Lambda functions that use environment variables. The company does not want its developers to see environment variables in plaintext.Which solution will meet these requirements?

Correct Answer: D. Create an AWS Key Management Service (AWS KMS) key. Enable encryption helpers on the Lambda functions to use the KMS key to store and encrypt the environment variables.

Explanation

The solution that will meet the requirements is option D: Create an AWS Key Management Service (AWS KMS) key. Enable encryption helpers on the Lambda functions to use the KMS key to store and encrypt the environment variables.To protect environment variables in Lambda functions and prevent developers from viewing them in plaintext, you can follow these steps:Step 1: Create an AWS Key Management Service (AWS KMS) key (Option D)AWS KMS provides a secure and scalable way to create and manage encryption keys. By creating an AWS KMS key, you can have control over the encryption and decryption of sensitive data, such as environment variables. The KMS key will be used to encrypt and decrypt the environment variables.Step 2: Enable encryption helpers on the Lambda functions (Option D)AWS Lambda provides encryption helpers that can automatically encrypt and decrypt environment variables using the KMS key. By enabling encryption helpers, you instruct Lambda to encrypt the environment variables before storing them and decrypt them when needed during runtime. This ensures that the environment variables are protected and not accessible in plaintext.Option A suggests deploying code to Amazon EC2 instances instead of using Lambda functions. While EC2 instances provide more control over the environment, they also require more management and maintenance compared to serverless Lambda functions.Option B suggests using AWS CloudHSM to store and encrypt the environment variables. CloudHSM is a hardware security module (HSM) that provides secure key storage and cryptographic operations. However, using CloudHSM for encrypting environment variables in Lambda functions can be complex and may not be necessary for this scenario.Option C suggests creating a certificate in AWS Certificate Manager (ACM) and configuring the Lambda functions to use the certificate to encrypt the environment variables. However, ACM certificates are primarily used for securing communication over HTTPS and may not be directly applicable for encrypting environment variables.Therefore, option D is the most suitable solution as it leverages AWS Key Management Service (KMS) and encryption helpers in Lambda to store and encrypt the environment variables, ensuring that they are protected and not accessible in plaintext.