Exam AWS Certified Security - Specialty topic 1 question 370 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 370
Topic #: 1

[All AWS Certified Security - Specialty Questions]

An Amazon API Gateway API invokes an AWS Lambda function that needs to interact with a software-as-a-service (SaaS) platform. A unique client token is generated in the SaaS platform to grant access to the Lambda function. A security engineer needs to design a solution to encrypt the access token at rest and pass the token to the Lambda function at runtime.

Which solution will meet these requirements MOST cost-effectively?

A. Store the client token as a secret in AWS Secrets Manager. Use the AWS SDK to retrieve the secretin the Lambda function.
B. Configure a token-based Lambda authorizer in API Gateway.
C. Store the client token as a SecureString parameter in AWS Systems Manager Parameter Store. Use the AWS SDK to retrieve the value of the SecureString parameter in the Lambda function.
D. Use AWS Key Management Service (AWS KMS) to encrypt the client token. Pass the token to the Lambda function at runtime through an environment variable.

Show Suggested Answer

Suggested Answer: C 🗳️

by AdamWest at Nov. 21, 2022, 1:41 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Toptip

2 years ago

Selected Answer: C

Param store - SecureString is FREE

upvoted 1 times

...

ITGURU51

2 years, 1 month ago

The most cost-effective solution to meet these requirements would be to store the client token as a SecureString parameter in AWS Systems Manager Parameter Store and use the AWS SDK to retrieve the value of the SecureString parameter in the Lambda function.C

upvoted 2 times

...

Ell89

2 years, 4 months ago

Selected Answer: C

C for cost effectiveness, systems manager parameter store trumps secrets manager

upvoted 3 times

...

secdaddy

2 years, 5 months ago

A unique client token is generated in the SaaS platform to grant access to the Lambda function (0) most cost effective solution to (1) encrypt the access token at rest and (2) pass the token to the Lambda function at runtime Unless I am mistaken a Lamda authorizer is Lambda side auth before execution of a Lambda function, not auth of Lambda to the SaaS application. If so, this eliminates B. A Secrets Manager & C Parameter Store seem to both be possible. Parameter Store is free, Secrets Manager is not so between these C is better but both incur some cost by using the AWS SDK. D seems possible but has a cost per key https://medium.com/@kush.saraiya/encrypting-environment-variables-in-aws-lambda-function-e09cdde9fef1 Hard to evaluate the costs on this but I think the 'MOST cost-effectively' is a hint to choose Parameter Store so I think C is the best answer. (disclaimer I have never worked with any of this and am just reading documentation)

upvoted 3 times

secdaddy

2 years, 5 months ago

Clarification - I read this "A unique client token is generated in the SaaS platform to grant access to the Lambda function" to mean that the token is used by the Lambda function to access the SaaS application, not the other way around.

upvoted 1 times

...

Fyssy

2 years, 6 months ago

Selected Answer: B

A Lambda authorizer is useful if you want to implement a custom authorization scheme that uses a bearer token authentication strategy such as OAuth or SAML, or that uses request parameters to determine the caller's identity. https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html

upvoted 1 times

...