How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

A company is developing a serverless application that requires storage of sensitive API keys as environment variables for various services. The application requires the automatic rotation of the encryption keys every year. Which solution will meet these requirements with no development effort?

Encrypt the environment variables by using AWS Secrets Manager. Set up automatic rotation in Secrets Manager.
Encrypt the environment variables by using AWS Key Management Service (AWS KMS) customer managed keys. Enable automatic key rotation. Source Reference Answer
Encrypt the environment variables by using AWS Key Management Service (AWS KMS) AWS managed keys. Configure a custom AWS Lambda function to automate key rotation.
Encrypt the environment variables by using AWS Systems Manager Parameter Store. Set up automatic rotation in Parameter Store.

Community Votes

57%

43%

57% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the distinction between rotating the encryption key (KMS) versus rotating the secret value itself (Secrets Manager), and which service requires development effort to enable rotation.

AWS KMS customer managed keys support automatic annual rotation with zero development effort, making them the correct choice for encrypting environment variables holding sensitive API keys in serverless applications.

Many candidates choose AWS Secrets Manager because it is commonly associated with storing API keys, but automatic rotation of secrets in Secrets Manager requires a custom Lambda function, which violates the 'no development effort' constraint.

Community Discussion (6 comments)

0bdf3af 👍 1 Selected: B

B is correct WIth custom key in KMS, we can set automatic rotation after 365. To configure rotation in Secrets Manager we need to provide lambda function. It is costs some develpment effort, right?

Arad 👍 2 Selected: B

B is the correct answer. A is wrong as Secret Manager is a place to store things, it does not encrypt things.

fbx01 👍 1 Selected: A

automatic rotation in Secrets Manager.

YUICH 👍 3

A. Encrypt the environment variables by using AWS Secrets Manager. Set up automatic rotation in Secrets Manager. Explanation: AWS Secrets Manager is designed specifically for securely managing sensitive information like API keys, database credentials, and other secrets. It provides: Built-in encryption using AWS Key Management Service (KMS). Automatic rotation of secrets with minimal effort. Secrets Manager has a native feature for automatic rotation that can be enabled for supported use cases. Integration with AWS services (e.g., Lambda, RDS, etc.). Key Features Satisfying the Requirements: The sensitive API keys can be stored securely as secrets. Automatic rotation can be set up without requiring custom development. Secrets Manager handles rotation using Lambda functions configured for this purpose.

albert_kuo 👍 1 Selected: B

AWS KMS supports key rotation

CloudChingon 👍 2 Selected: A

Meets the encryption and key rotation requirement but requires additional development to manage secrets rotation. A is correct

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

The correct answer is B: Encrypt the environment variables by using AWS Key Management Service (AWS KMS) customer managed keys. Enable automatic key rotation.

The key phrase in the question is "automatic rotation of the encryption keys every year" with "no development effort". AWS KMS customer managed keys support automatic key rotation on a yearly basis (every 365 days) with a simple configuration toggle in the AWS Console or via CLI. This rotation is handled entirely by AWS and requires zero development effort. When a key is rotated, KMS retains the old key material to decrypt previously encrypted data, while new encryption uses the new key material. This is transparent to the application.

Why Option A is wrong: AWS Secrets Manager is designed to store and rotate secret values (like API keys, database credentials), not to encrypt environment variables directly. While Secrets Manager can rotate secrets automatically, doing so for custom secrets (like API keys) requires writing a custom AWS Lambda function to define the rotation logic. This violates the "no development effort" requirement. Additionally, Secrets Manager uses KMS under the hood for encryption—it is not itself an encryption service for environment variables.

Why Option C is wrong: AWS managed keys (e.g., aws/lambda) do not support automatic key rotation. Only customer managed keys support this feature. Furthermore, configuring a custom Lambda function again violates the "no development effort" constraint.

Why Option D is wrong: AWS Systems Manager Parameter Store does not natively support automatic rotation of parameters. While SecureString parameters are encrypted using KMS, Parameter Store itself has no built-in rotation capability. You would need to build custom automation (e.g., Lambda + EventBridge), which again requires development effort.

Community consensus strongly supports B (57%), with commenters correctly noting that Secrets Manager rotation requires a Lambda function (development effort), while KMS customer managed key rotation is a simple toggle.

Official Reference

Exam Strategy

When a question emphasizes 'no development effort' or 'minimal effort,' immediately eliminate options that require custom Lambda functions or manual scripting. Pay close attention to whether the question asks about rotating the encryption key (KMS feature) versus rotating the secret value (Secrets Manager feature)—these are fundamentally different operations.

Related Analysis

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide