A Lambda function needs a database password. Which approach keeps the secret out of code AND rotates it automatically?
A.Hard-code it in an environment variable
Plaintext env vars are visible to anyone with console/API read access.
B.Store it in Secrets Manager and fetch it at runtime (or via the Secrets Manager extension) — with rotation enabled
Correct. Managed secret + automatic rotation + no redeploys on change.
C.Commit it to the deployment package's config file
Secrets in code get committed to version control eventually.
D.Base64-encode it in an environment variable
Base64 is encoding, not encryption — trivially reversible.
Why this answer
Secrets Manager stores, encrypts, and can automatically rotate credentials; Lambda fetches the current value at runtime or via the AWS Parameters and Secrets extension. Environment variables persist plaintext (visible in console) and don't rotate.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Serverless & APIs practice session.
Practice Serverless & APIs