A Lambda needs an API key that rarely rotates. Secrets Manager costs $0.40/secret/month. What's the cheaper acceptable option?
A.SSM Parameter Store SecureString encrypted with KMS
Correct — KMS-encrypted and free under standard tier limits.
B.Plaintext in Parameter Store
String (not SecureString) parameters are stored unencrypted.
C.Encrypted env var with the default lambda key
Env vars decrypt at the function layer for anyone with read access — weaker than parameter+KMS scoping.
D.Commit it to the repo and read at deploy time
Secrets in git are a breach pattern, not an option.
Why this answer
SecureString parameters are KMS-encrypted, free for the standard tier (up to 10K params), and auditable — the cost-effective secret store when rotation isn't needed. Plaintext parameters aren't encrypted.
Correct answer: A · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security