How to Securely Store Encrypted Credentials for AWS Lambda?

DVA-C02 By islever Editorial Last updated

Short answer

B Move the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store.

Question

A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to the company's SFTP server. The Lambda function connects to the SFTP server by using credentials such as username and password. The company uses Lambda environment variables to store these credentials. A developer needs to implement encrypted username and password credentials. Which solution will meet these requirements?
  1. Remove the user credentials from the Lambda environment. Implement IAM database authentication.
  2. Move the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store. Correct Answer
  3. Move the user credentials from Lambda environment variables to AWS Key Management Service (AWS KMS).
  4. Move the user credentials from the Lambda environment to an encrypted .txt file. Store the file in an S3 bucket.

Key Takeaways

This question tests the distinction between AWS KMS (a key management service, not a data store) and AWS Systems Manager Parameter Store (a secure data store that uses KMS for encryption).

AWS Systems Manager Parameter Store is the recommended service for storing encrypted credentials (like SFTP usernames and passwords) used by Lambda functions, leveraging AWS KMS for encryption at rest and in transit.

Common mistake: Many candidates choose C (AWS KMS) because the question mentions encryption, but KMS is designed to manage encryption keys, not to store credentials directly.

Expert Analysis

Correct Answer: B

AWS Systems Manager Parameter Store is the correct solution because it is specifically designed to securely store configuration data and secrets, including sensitive information like usernames and passwords. When you create a parameter of type SecureString, Parameter Store automatically encrypts the value using an AWS KMS customer-managed or AWS-managed key. This provides strong encryption at rest and in transit, along with fine-grained IAM-based access control.

Why the Other Options Are Incorrect

  • Option A (IAM database authentication): IAM database authentication is applicable to Amazon RDS and Amazon Aurora databases, not to external SFTP servers. The SFTP server in this scenario uses traditional username/password credentials, so IAM auth is irrelevant.
  • Option C (AWS KMS): This is the most common trap. AWS KMS is a service for creating and managing cryptographic keys; it is not a data store. You cannot store credentials directly in KMS. Instead, KMS is used by Parameter Store (or Secrets Manager) to encrypt the stored values.
  • Option D (Encrypted .txt file in S3): While technically possible, storing credentials in an encrypted file in S3 introduces unnecessary complexity. The Lambda function would need to download, decrypt, and parse the file on every invocation, adding latency and operational overhead. Parameter Store is purpose-built for this use case and integrates natively with Lambda.

Community Insights

As noted by community members, you can store the SFTP username and password as two separate SecureString parameters in Parameter Store and retrieve them in your Lambda function using the AWS SDK (e.g., boto3 with WithDecryption=True). This approach is both secure and operationally simple.

import boto3
ssm = boto3.client('ssm')
username = ssm.get_parameter(Name='SFTPUsername', WithDecryption=True)['Parameter']['Value']
password = ssm.get_parameter(Name='SFTPPassword', WithDecryption=True)['Parameter']['Value']

Candidates who chose D argued that Parameter Store does not encrypt by default, but this is a misunderstanding—choosing the SecureString type enables KMS encryption automatically.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks about storing encrypted credentials or secrets in AWS, always look for AWS Systems Manager Parameter Store or AWS Secrets Manager as the answer. Avoid choosing AWS KMS unless the question specifically asks about managing encryption keys themselves.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. rdiaz 👍 2 Answered B
    parameter store is the most suitable option
  2. examuserss 👍 1 Answered B
    The best solution is B. Move the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store. Here's why: Parameter Store is designed for securely storing sensitive information. It allows you to encrypt parameters (like usernames and passwords) using AWS KMS, offering strong encryption at rest and in transit. Parameter Store also provides fine-grained access control, ensuring only authorized entities can retrieve the credentials.
  3. xdeveloper 👍 1 Answered B
    AWS Key Management Service (KMS) is used for managing encryption keys but is not intended to directly store sensitive data like credentials. You would use KMS for encrypting data, and you would still need a service like Parameter Store to store and retrieve the encrypted credential
  4. albert_kuo 👍 1 Answered B
    import boto3 import os ssm = boto3.client('ssm') def lambda_handler(event, context): username = ssm.get_parameter(Name='SFTPUsername', WithDecryption=True)['Parameter']['Value'] password = ssm.get_parameter(Name='SFTPPassword', WithDecryption=True)['Parameter']['Value']
  5. 28304e5 👍 1
    Answer: D The question explicitly states that the credentials must be encrypted. AWS Systems Manager Parameter does not encrypt the parameters by default, so B does not work as it doesn't state that encryption has been enabled.
Show 2 more comments
  1. preachr 👍 1 Answered B
    We can use two SecureString parameters—one for the SFTP username and one for the SFTP password.
  2. 28304e5 👍 1 Answered D
    D is only answer that clearly encrypts the credentials.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide