A solutions architect is auditing the security setup or an AWS Lambda function for a company. The Lambda function retrieves, the latest changes from an Amazon Aurora database. The Lambda function and the database run in the same VPC. Lambda environment variables are providing the database credentials to the Lambda function. The Lambda function aggregates data and makes the data available in an Amazon S3 bucket that is configured for server-side encryption with AWS KMS managed encryption keys (SSE-KMS). The data must not travel across the Internet. If any database credentials become compromised, the company needs a solution that minimizes the impact of the compromise. What should the solutions architect recommend to meet these requirements?
Select one answer.
Marked answer: A
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose A2
The best answer is Option A. It uses IAM database authentication, which eliminates the need for storing or rotating static credentials by using short-lived IAM tokens. This significantly reduces the impact of credential compromise. It also includes a VPC gateway endpoint for S3, ensuring that data transfers stay within AWS and do not traverse the public internet. This setup provides both strong security and low operational overhead, making it the best choice overall.
Chose D1
Option A does not address the requirement for rotating database credentials.
1
A. Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
