Question

A developer needs to store a static third-party API key that their Lambda function reads at runtime. The key never changes and does not require automatic rotation. The team wants to encrypt the value at rest, control access with IAM, and minimize cost while avoiding hardcoding the key in the function. Which approach best meets these requirements?

Accepted Answer

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store and grant the Lambda execution role permission to read it and decrypt with KMS.

Answer

Store the API key in AWS Secrets Manager with automatic rotation enabled and retrieve it in the function.

Answer

Store the API key as a plaintext Lambda environment variable and restrict access with the function's resource policy.

Answer

Hardcode the API key in the deployment package but encrypt the entire ZIP file with a customer managed KMS key.