DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure the Lambda function to use IAM database authentication for RDS.

  Why this is correct

  Configuring the Lambda function to use IAM database authentication for RDS is the most secure and recommended approach. This method allows the Lambda function to connect using its execution role, generating short-lived, temporary authentication tokens instead of relying on static usernames and passwords. It eliminates the need to store or manage long-term database credentials, significantly enhancing security by leveraging AWS IAM's robust permission model and automatic credential rotation.

• ✗

  Store the password as a Lambda environment variable encrypted with KMS.

  Why it's wrong here

  Storing a password as a Lambda environment variable, even if encrypted with KMS, is not a secure practice for sensitive data. While KMS encrypts the variable at rest, it is decrypted and exposed in plain text to the Lambda runtime environment. This creates a vulnerability where anyone with console access to the Lambda function could potentially view the decrypted password, or it could be inadvertently logged in application logs.

• ✗

  Use the AWS CLI within the Lambda function to fetch the secret each time.

  Why it's wrong here

  Using the AWS CLI within a Lambda function to fetch a secret each time, typically from AWS Secrets Manager or Parameter Store, still relies on the existence of a traditional database password. Although this approach avoids hardcoding credentials, it introduces network latency for each retrieval and requires the Lambda function's role to have permissions to access the secret store. This method does not eliminate the fundamental security concern of managing and transmitting a password, unlike IAM database authentication.

• ✗

  Rotate the secret daily using Secrets Manager and cache it in Lambda.

  Why it's wrong here

  Rotating a secret daily using Secrets Manager and caching it in Lambda improves security over static credentials, but it fundamentally still depends on a traditional password. While caching reduces the frequency of secret retrieval, the Lambda function still needs to handle and manage a password, even if it's frequently updated. This approach is less secure than IAM database authentication, which completely eliminates the need for a password by using temporary, role-based tokens.