Exam AWS Certified Developer - Associate DVA-C02 topic 1 question 386 discussion

The best solution is B. Move the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store. Here's why: Parameter Store is designed for securely storing sensitive information. It allows you to encrypt parameters (like usernames and passwords) using AWS KMS, offering strong encryption at rest and in transit. Parameter Store also provides fine-grained access control, ensuring only authorized entities can retrieve the credentials.

AWS Key Management Service (KMS) is used for managing encryption keys but is not intended to directly store sensitive data like credentials. You would use KMS for encrypting data, and you would still need a service like Parameter Store to store and retrieve the encrypted credential

We can use two SecureString parameters—one for the SFTP username and one for the SFTP password.

import boto3 import os ssm = boto3.client('ssm') def lambda_handler(event, context): username = ssm.get_parameter(Name='SFTPUsername', WithDecryption=True)['Parameter']['Value'] password = ssm.get_parameter(Name='SFTPPassword', WithDecryption=True)['Parameter']['Value']

D is only answer that clearly encrypts the credentials.

Answer: D The question explicitly states that the credentials must be encrypted. AWS Systems Manager Parameter does not encrypt the parameters by default, so B does not work as it doesn't state that encryption has been enabled.

parameter store is the most suitable option