A Lambda function needs a database password. What's the recommended way to supply it securely?
A.Plaintext environment variable
Env vars are visible in the console/CLI to anyone with lambda:GetFunction — not secret-safe.
B.Secrets Manager (or SSM SecureString), retrieved at runtime and cached outside the handler
Correct — encrypted storage, rotation, and audit trail.
C.Hardcode it in the deployment package
Hardcoded secrets leak into version control and layers — a classic incident.
D.Pass it in the invocation payload
Invocation payloads end up in logs and event sources — not a secret channel.
Why this answer
Secrets Manager encrypts, rotates, and audits secrets — fetch during the init phase (outside the handler) and cache across warm invocations. Plaintext env vars are visible to anyone with function read access.
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Serverless & APIs practice session.
Practice Serverless & APIs