SAA-C03 Q170 · Security

Question

A company has AWS Lambda functions that use environment variables. The company does not want its developers to see environment variables in plaintext. Which solution will meet these requirements?

Accepted Answer

**Option D: AWS KMS key with Lambda encryption helpers** is correct because:

1. **Requirement: Hide environment variables from developers in plaintext** — Lambda already encrypts environment variables at rest using a default service key, but developers with console access can still **see the decrypted values** in the Lambda console. The requirement is to prevent even this visibility.

2. **How encryption helpers work:** Lambda provides built-in **encryption helpers** in the console. When you enable them with a customer-managed KMS key, Lambda encrypts the environment variable values **before deployment** (client-side encryption). The values are stored as ciphertext.

3. **Plaintext is never visible in the console:** After enabling encryption helpers, the environment variable values appear

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips