Encrypting Lambda Environment Variables with KMS
Short answer
D Create an AWS Key Management Service (AWS KMS) key and enable encryption helpers on the Lambda functions to store and encrypt the environment variables.
Question
Key Takeaways
The core concept is that while Lambda supports native encryption for environment variables via KMS, developers must explicitly enable this feature to prevent plaintext exposure.
This question examines AWS security controls for protecting sensitive data in serverless environments, specifically focusing on the encryption of Lambda environment variables using AWS KMS.
Common mistake: Candidates often confuse this with general SSL/TLS encryption or choose to move workloads to EC2, failing to recognize the specific native integration between Lambda and KMS for variable storage.
Expert Analysis
Why the Answer Is Correct
Option D is correct because AWS Lambda provides a built-in feature called 'encryption helpers' that integrates directly with AWS Key Management Service (KMS). By creating a KMS key and enabling these helpers in the Lambda configuration, any environment variables marked for encryption are automatically encrypted at rest and decrypted only when accessed by the function code. This ensures that developers cannot view the secrets in plaintext within the console or code.
Why the Other Options Are Wrong
Option A is incorrect because moving to EC2 does not solve the problem; EC2 instance metadata and environment variables can also be exposed if not managed securely, and it increases operational overhead unnecessarily. Option B is incorrect because SSL/TLS encrypts data in transit, not the static storage of environment variables, and CloudHSM is an over-engineered solution not required for this use case. Option C is incorrect because ACM is designed for managing certificates for HTTPS services, not for encrypting application data like environment variables.
Community Comment Notes
The community consensus strongly supports Option D, with users noting that while Parameter Store is a valid alternative, the question specifically tests the native Lambda encryption helper feature. As one user noted, "AWS KMS is the primary service for managing encryption keys... ensuring that environment variables are stored and accessed in an encrypted format." Another user highlighted the official documentation reference confirming this capability.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always look for native integrations first; AWS often builds security features directly into services like Lambda or S3 rather than requiring external tools. If a question asks about securing configuration data, consider both AWS Secrets Manager/Parameter Store and native service encryption features.
Frequently Asked Questions
Why not use AWS Systems Manager Parameter Store instead?
Does enabling encryption helpers affect Lambda cold starts?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
osmk 👍 7 Answered Dhttps://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption
-
MatAlves 👍 2"To configure encryption for your environment variables Enable console encryption helpers to use client-side encryption to protect your data in transit. Under Encryption in transit, choose Enable helpers for encryption in transit. For each environment variable that you want to enable console encryption helpers for, choose Encrypt next to the environment variable. Under AWS KMS key to encrypt in transit, choose a customer managed key that you created at the beginning of this procedure."
-
Rhydian25 👍 2 Answered DI don't understand why we should use a complex way of encrypting variables instead of using Parameter Store... but in this case the best option is D
-
JA2018 👍 1 Answered DReasons for choosing D: AWS KMS is the primary service for managing encryption keys in AWS. This makes it the most appropriate choice for encrypting sensitive environment variables within Lambda functions. Encryption helpers in Lambda allow you to easily integrate KMS key usage within your Lambda code, ensuring that environment variables are stored and accessed in an encrypted format.
-
Andy_09 👍 7Option D
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →