Question

A developer builds a Lambda function that connects to a third-party payment API using a secret API key. The key must be passed to the function code at runtime, and the security team requires that the value never appear in plaintext in the Lambda console or in AWS CloudTrail logs, while keeping the solution simple and cost-effective. Which approach best meets these requirements?

Accepted Answer

Store the API key as a Lambda environment variable and enable encryption in transit using a customer managed AWS KMS key, decrypting the value in the function handler with the AWS SDK.

Answer

Hard-code the API key as a constant in the function source code and rely on the Lambda execution environment isolation to protect it.

Answer

Store the API key as a plaintext Lambda environment variable and restrict access to the function using the execution role.

Answer

Pass the API key as part of every synchronous invocation event payload from the calling application.