Least Overhead Secure Storage for Lambda Secrets

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

BC Store sensitive information in AWS Secrets Manager and create a Lambda layer that retrieves sensitive information.

Question

A company runs thousands of AWS Lambda functions. The company needs a solution to securely store sensitive information that all the Lambda functions use. The solution must also manage the automatic rotation of the sensitive information. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
  1. Create HTTP security headers by using Lambda@Edge to retrieve and create sensitive information
  2. Create a Lambda layer that retrieves sensitive information Correct Answer
  3. Store sensitive information in AWS Secrets Manager Correct Answer
  4. Store sensitive information in AWS Systems Manager Parameter Store
  5. Create a Lambda consumer with dedicated throughput to retrieve sensitive information and create environmental variables

Key Takeaways

The key insight is distinguishing between Parameter Store (which lacks native auto-rotation) and Secrets Manager (which includes it), while recognizing that Lambda layers reduce operational overhead by centralizing retrieval logic.

This question addresses the secure storage and automatic rotation of sensitive information for AWS Lambda functions with minimal operational overhead. The correct solution involves using AWS Secrets Manager for its native rotation capabilities combined with a Lambda layer to minimize code duplication.

Common mistake: Many learners select D (Parameter Store) because it is free and commonly used, failing to notice that the question explicitly requires 'automatic rotation,' which Parameter Store does not support natively without custom Lambda functions.

Expert Analysis

Why the Answer Is Correct

AWS Secrets Manager (Option C) is designed specifically for storing secrets like passwords and API keys and provides built-in, automated rotation mechanisms, satisfying the core requirement. Creating a Lambda layer (Option B) allows multiple Lambda functions to share the same code for retrieving these secrets from Secrets Manager via the SDK or extensions. This approach significantly reduces operational overhead compared to duplicating retrieval logic in thousands of separate functions.

Why the Other Options Are Wrong

Option A (Lambda@Edge) is intended for CloudFront edge computing, not general secret storage. Option D (Parameter Store) is less suitable because it does not offer native automatic rotation; implementing rotation would require additional Lambda functions and IAM roles, increasing operational overhead. Option E (Environmental Variables) is insecure for sensitive data and requires manual updates, violating both security and automation requirements.

Community Comment Notes

Community consensus strongly favors BC, with users noting that Parameter Store lacks automatic rotation. One user noted "C. Store sensitive information in AWS Secrets Manager" as the primary driver for rotation capabilities. Another comment highlighted that "D doesn't provide automatic rotation," reinforcing why C is superior to D for this specific constraint.

Exam Strategy

When asked about 'automatic rotation' of secrets, always choose Secrets Manager over Parameter Store unless specified otherwise. For 'least operational overhead' involving shared logic across many functions, consider Lambda Layers to avoid code duplication.

Frequently Asked Questions

Why can't I use Parameter Store for automatic rotation?

Parameter Store does not have native automatic rotation features. Implementing rotation would require writing custom Lambda functions, increasing operational overhead.

Is a Lambda layer necessary if I can just import the SDK?

While you can import the SDK, a Lambda layer centralizes the retrieval logic/code for all functions. This reduces maintenance overhead when updating how secrets are fetched across thousands of functions.

More SAA-C03 FAQ →

Community Votes

BC
100%

100% of anonymous learners picked answer BC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. [Removed] 👍 8
    C. Store sensitive information in AWS Secrets Manager. AWS Secrets Manager securely stores sensitive information and provides automatic rotation of secrets, reducing the need for manual management. B. Create a Lambda layer that retrieves sensitive information. Using a Lambda layer allows multiple Lambda functions to access the sensitive information stored in Secrets Manager without needing to duplicate retrieval logic in each function. This approach centralizes the retrieval process and reduces operational complexity.
  2. pujithacg8 👍 8
    D doesn't provide automatic rotation Answer will be B and C
  3. LeonSauveterre 👍 3
    A - Lambda@Edge is primarily used for managing HTTP request/response behavior in a CDN environment with Amazon CloudFront. It is not designed for securely storing or rotating sensitive information. B - By creating a layer that securely retrieves sensitive information (for example, from AWS Secrets Manager), we will reduce duplication and operational overhead. The layer can also handle the logic for retrieving updated information if needed. C - Automatic rotation is managed. D - Automatic rotation is NOT managed. E - Setting environment variables dynamically at runtime is not an efficient or scalable practice for "thousands of Lambda functions". Too much operational overhead.
  4. example_ 👍 1
    https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-integration-lambda-extensions.html https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/using-aws-secrets-manager-and-lambda-function-to-store-rotate-and-secure-keys/
  5. Sarayounisaldossary 👍 1
    A. Lambda@Edge: Not relevant for secrets; Used for CDN/CloudFront. D. Parameter Store: Doesn’t support auto-rotation as easily as Secrets Manager. E. Env Variables: Not secure and needs manual management.
Show 3 more comments
  1. agbor_tambe 👍 2
    BC is correct
  2. progounick 👍 1
    B,C ChatGPT agrees with me
  3. komorebi 👍 1
    Answer is CD

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide