Question

A high-traffic serverless application runs thousands of concurrent AWS Lambda function invocations. Each invocation currently calls GetSecretValue from AWS Secrets Manager to retrieve a database credential before connecting. The team observes ThrottlingException errors from Secrets Manager during peak load and rising API costs. The credential is rotated every 30 days. Which approach BEST reduces the API call volume while keeping credentials current and secure?

Accepted Answer

Use the AWS Parameters and Secrets Lambda Extension to cache the secret in the function's execution environment and refresh it on a configurable TTL.

Answer

Copy the secret value into a Lambda environment variable during deployment so no runtime API calls are needed.

Answer

Move the credential to AWS Systems Manager Parameter Store as a SecureString to avoid Secrets Manager throttling limits entirely.

Answer

Request a Secrets Manager service quota increase for GetSecretValue and add exponential backoff retries on each invocation.