AWS Certified Security – Specialty — Question 281

A company's policy requires that all API keys be encrypted and stored separately from source code in a centralized security account. This security account is managed by the company's security team. However, an audit revealed that an API key is stored with the source code of an AWS Lambda function in an AWS
CodeCommit repository in the DevOps account.
How should the security team securely store the API key?

Answer options

• A. Create a CodeCommit repository in the security account using AWS Key Management Service (AWS KMS) for encryption. Require the development team to migrate the Lambda source code to this repository.
• B. Store the API key in an Amazon S3 bucket in the security account using server-side encryption with Amazon S3 managed encryption keys (SSE-S3) to encrypt the key. Create a presigned URL for the S3 key, and specify the URL in a Lambda environmental variable in the AWS CloudFormation template. Update the Lambda function code to retrieve the key using the URL and call the API.
• C. Create a secret in AWS Secrets Manager in the security account to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the function can retrieve the key from Secrets Manager and call the API.
• D. Create an encrypted environment variable for the Lambda function to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the function can decrypt the key at runtime.

Correct answer: C

Explanation

AWS Secrets Manager is the standard service for securely storing, rotating, and managing sensitive data like API keys, making Option C the correct choice as it centralizes the key in the security account and uses KMS for encryption. Option A keeps the key in the source code repository, while Option D stores the key directly in the DevOps account's Lambda environment variables, violating the policy of storing keys in the centralized security account. Option B is incorrect because utilizing presigned S3 URLs is an insecure and overly complex method for managing secrets compared to native AWS Secrets Manager integration.