You created a customer-managed AWS KMS key and must ensure sensitive configuration data (API keys, etc.) used by a Lambda-based application is encrypted in transit. What should you do next to satisfy the encryption requirement?
Choose an answer
Tap an option to check your answer.
Correct answer: Use encrypted Lambda environment variables encrypted with the customer-managed KMS key, enable encryption helpers for in-transit encryption, and grant the function's execution role KMS access..
Why this is the answer
The most direct and efficient way to encrypt sensitive configuration data for a Lambda function in transit is by using encrypted Lambda environment variables. AWS Lambda natively supports encrypting environment variables using a customer-managed KMS key. When you configure this, AWS handles the encryption and decryption automatically, and the data is decrypted only when the function is invoked. You must grant the Lambda function's execution role permissions to use the specified KMS key. Storing values in Systems Manager Parameter Store or Secrets Manager are viable options for secrets management, but they introduce additional service calls and latency for each parameter retrieval. Storing individual fields as S3 objects is overly complex and inefficient for configuration data.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed