How to securely store an external API key in AWS Lambda with full KMS control?

DVA-C02 By islever Editorial Last updated

Short answer

B Store the API key in AWS Lambda environment variables. Create an AWS KMS customer managed key to encrypt the API key.

Question

A company is building a serverless application. The application uses an API key to authenticate with a third-party application. The company wants to store the external API key as a part of an AWS Lambda configuration. The company needs to have full control over the AWS Key Management Service (AWS KMS) keys that will encrypt the API key and should be visible only to authorized entities. Which solution will meet these requirements?
  1. Store the API key in AWS Systems Manager Parameter Store as a string parameter. Use the default AWS KMS key that AWS provides to encrypt the API key.
  2. Store the API key in AWS Lambda environment variables. Create an AWS KMS customer managed key to encrypt the API key. Correct Answer
  3. Store the API key in the code repository. Use an AWS managed key to encrypt the code repository.
  4. Store the API key as an Amazon DynamoDB table record. Use an AWS managed key to encrypt the API key.

Key Takeaways

The question tests your knowledge of AWS KMS key types and Lambda encryption options; the key trap is preferring Parameter Store while ignoring the need for customer managed KMS keys with full control.

For securely storing an external API key in a serverless application, the community agrees using Lambda environment variables encrypted with a customer managed KMS key (Option B) best meets requirements for full control and visibility.

Common mistake: Choosing Option A (Parameter Store with the default AWS KMS key) is common because Parameter Store can store secrets, but it fails because the default AWS-managed key does not give full control over the KMS key.

Expert Analysis

Why the Answer Is Correct

Option B is correct because Lambda environment variables support encryption using AWS KMS, and you can choose a customer managed KMS key for full control. The requirement states the company needs full control over the KMS keys, which only a customer managed key provides. Storing the API key in Lambda environment variables is also a standard, secure pattern for serverless applications.

Why the Other Options Are Wrong

Option A uses Parameter Store, which can store secrets, but the default AWS-managed KMS key does not provide full control to the customer, violating the requirement. Option C storing the API key in a code repository is insecure and does not explain KMS key control. Option D uses DynamoDB, which is unnecessary and still uses AWS managed keys rather than customer managed keys. Only B combines the correct secret storage service with the required customer controlled KMS key.

Community Comment Notes

Comments from users confirm that B is the only answer that satisfies the full control requirement. One commenter specifically noted, 'The company needs to have full control over AWS KMS => customer managed key in AWS KMS.' Another linked the official Lambda documentation for environment variable encryption, which directly supports using customer managed keys. The unanimous vote (100% for B) reinforces the consensus.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question explicitly mentions 'full control over AWS KMS keys', immediately think customer managed key. Look for the storage option that allows attaching a customer managed key—Lambda environment variables or Parameter Store with a customer managed key both work, but the option must specify the correct key type.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. KarBiswa 👍 6 Answered B
    https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption:~:text=If%20you%20prefer,on%20the%20function.
  2. Lucky4Life 👍 2 Answered B
    By creating a customer managed key in AWS Key Management Service (KMS), you gain full control over the encryption process.
  3. albert_kuo 👍 1 Answered B
    The company needs to have full control over the AWS Key Management Service (AWS KMS) => customer managed key in AWS Key Management Service (KMS)
  4. preachr 👍 1 Answered B
    https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html
  5. 65703c1 👍 1 Answered B
    B is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide