During a review of thousands of AWS Lambda functions, a security engineer finds sensitive data in environment variables that are visible as plaintext in the Lambda console. The secrets are short values. What is the most cost-effective remediation?

Storing sensitive data as secure string parameters in AWS Systems Manager Parameter Store is the most cost-effective and secure remediation. Parameter Store offers a free tier that covers a high volume of requests, making it economical for retrieving short, sensitive values. It integrates seamlessly with IAM for fine-grained access control, ensuring only authorized Lambda functions can retrieve the secrets at runtime. AWS Secrets Manager is a valid secure option but is generally more expensive, as it charges per secret stored and per API call, making it less cost-effective for a large number of short, simple secrets. IAM policies from the Lambda console only restrict viewing the variables, not their underlying insecure storage. AWS Step Functions are not designed for secret storage; they orchestrate workflows, and using them for this purpose would be an anti-pattern and incur unnecessary costs and complexity.