Question

A data science team is building an application that calls a third-party foundation model API from within an AWS Lambda function. The API requires a secret key for authentication. The team currently hardcodes the key in the Lambda environment variables, but the security team flagged this as a risk and requires automatic rotation and encrypted storage of the credential. Which AWS service should the team use to address this requirement?

Accepted Answer

AWS Secrets Manager to store the API key with encryption and automatic rotation, retrieved by the Lambda function at runtime

Answer

AWS Systems Manager Parameter Store standard parameters to store the key as plaintext for easy access

Answer

Amazon S3 with a bucket policy restricting access to the Lambda execution role

Answer

AWS CloudTrail to log every use of the API key for auditing purposes