How to Securely Store Encrypted Credentials for AWS Lambda?
A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to the company's SFTP server. The Lambda function connects to the SFTP server by using credentials such as username and password. The company uses Lambda environment variables to store these credentials. A developer needs to implement encrypted username and password credentials. Which solution will meet these requirements?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the distinction between AWS KMS (a key management service, not a data store) and AWS Systems Manager Parameter Store (a secure data store that uses KMS for encryption).
AWS Systems Manager Parameter Store is the recommended service for storing encrypted credentials (like SFTP usernames and passwords) used by Lambda functions, leveraging AWS KMS for encryption at rest and in transit.
Many candidates choose C (AWS KMS) because the question mentions encryption, but KMS is designed to manage encryption keys, not to store credentials directly.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Correct Answer: B
AWS Systems Manager Parameter Store is the correct solution because it is specifically designed to securely store configuration data and secrets, including sensitive information like usernames and passwords. When you create a parameter of type SecureString, Parameter Store automatically encrypts the value using an AWS KMS customer-managed or AWS-managed key. This provides strong encryption at rest and in transit, along with fine-grained IAM-based access control.
Why the Other Options Are Incorrect
- Option A (IAM database authentication): IAM database authentication is applicable to Amazon RDS and Amazon Aurora databases, not to external SFTP servers. The SFTP server in this scenario uses traditional username/password credentials, so IAM auth is irrelevant.
- Option C (AWS KMS): This is the most common trap. AWS KMS is a service for creating and managing cryptographic keys; it is not a data store. You cannot store credentials directly in KMS. Instead, KMS is used by Parameter Store (or Secrets Manager) to encrypt the stored values.
- Option D (Encrypted .txt file in S3): While technically possible, storing credentials in an encrypted file in S3 introduces unnecessary complexity. The Lambda function would need to download, decrypt, and parse the file on every invocation, adding latency and operational overhead. Parameter Store is purpose-built for this use case and integrates natively with Lambda.
Community Insights
As noted by community members, you can store the SFTP username and password as two separate SecureString parameters in Parameter Store and retrieve them in your Lambda function using the AWS SDK (e.g., boto3 with WithDecryption=True). This approach is both secure and operationally simple.
``python
import boto3
ssm = boto3.client('ssm')
username = ssm.get_parameter(Name='SFTPUsername', WithDecryption=True)['Parameter']['Value']
password = ssm.get_parameter(Name='SFTPPassword', WithDecryption=True)['Parameter']['Value']
``
Candidates who chose D argued that Parameter Store does not encrypt by default, but this is a misunderstanding—choosing the SecureString type enables KMS encryption automatically.
Official Reference
Exam Strategy
When a question asks about storing encrypted credentials or secrets in AWS, always look for AWS Systems Manager Parameter Store or AWS Secrets Manager as the answer. Avoid choosing AWS KMS unless the question specifically asks about managing encryption keys themselves.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →