AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 79

Question

A company's policy requires that all API keys be encrypted and stored separately from source code in a centralized security account. This security account is managed by the company's security team. However, an audit revealed that an API key is stored with the source code of an AWS Lambda function in an AWS CodeCommit repository in the DevOps account. How should the security team securely store the API key?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Create a secret in AWS Secrets Manager in the security account to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the funct... AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

AWS Certified Security - Specialty SCS-C02 — Question 79