How to securely store an external API key in AWS Lambda with full KMS control?
A company is building a serverless application. The application uses an API key to authenticate with a third-party application. The company wants to store the external API key as a part of an AWS Lambda configuration. The company needs to have full control over the AWS Key Management Service (AWS KMS) keys that will encrypt the API key and should be visible only to authorized entities. Which solution will meet these requirements?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests your knowledge of AWS KMS key types and Lambda encryption options; the key trap is preferring Parameter Store while ignoring the need for customer managed KMS keys with full control.
For securely storing an external API key in a serverless application, the community agrees using Lambda environment variables encrypted with a customer managed KMS key (Option B) best meets requirements for full control and visibility.
Choosing Option A (Parameter Store with the default AWS KMS key) is common because Parameter Store can store secrets, but it fails because the default AWS-managed key does not give full control over the KMS key.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because Lambda environment variables support encryption using AWS KMS, and you can choose a customer managed KMS key for full control. The requirement states the company needs full control over the KMS keys, which only a customer managed key provides. Storing the API key in Lambda environment variables is also a standard, secure pattern for serverless applications.
Why the Other Options Are Wrong
Option A uses Parameter Store, which can store secrets, but the default AWS-managed KMS key does not provide full control to the customer, violating the requirement. Option C storing the API key in a code repository is insecure and does not explain KMS key control. Option D uses DynamoDB, which is unnecessary and still uses AWS managed keys rather than customer managed keys. Only B combines the correct secret storage service with the required customer controlled KMS key.
Community Comment Notes
Comments from users confirm that B is the only answer that satisfies the full control requirement. One commenter specifically noted, 'The company needs to have full control over AWS KMS => customer managed key in AWS KMS.' Another linked the official Lambda documentation for environment variable encryption, which directly supports using customer managed keys. The unanimous vote (100% for B) reinforces the consensus.
Official Reference
Exam Strategy
When a question explicitly mentions 'full control over AWS KMS keys', immediately think customer managed key. Look for the storage option that allows attaching a customer managed key—Lambda environment variables or Parameter Store with a customer managed key both work, but the option must specify the correct key type.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →