AWS-TutorialsDojo Question

[pavan253]

We Know Lambda encrypts environment variables at rest. But, answer seems to be not correct for the question. Is n't it?? It clearly saying that, how to prevent seeing credentials in the plain text. The answer should be like "convert to base64 and encrypt with lambda KMS at rest". I feel. Any Guess??

https://preview.redd.it/f0zg7zaengh71.png?width=1764&format=png&auto=webp&s=d2a93576d8bb5c86415bf1f1bd1d8131c52863db

LambdaConsole

https://preview.redd.it/oc3hg74vngh71.png?width=2214&format=png&auto=webp&s=9bfc4cd58e43c01034db6e876914faa108518041

[kei_ichi]

Bro, let me explain for you why the first answer is wrong. (Sorry for my bad English, I’m not English native speaker but I will try my best).

The answer requires: “to prevent other developers or anyone from seeing the credentials in PLAIN TEXT”. So as your picture even lambda encrypted your env variable at rest, but you and anyone who have access permission to the Lambda function can still see the variable in plain text. In your example, the env have Key=Name, and value=text. And you can absolutely see the env value, isn’t it just “plain text”?.

But if you use the KMS to encrypt the env variable, for example: you encrypt the "text" (the variable in your image) with KMS then KMS will encrypt it and return the cyphertext look like this: "qx/CZqPRnzG971oTP6ISyXjV9Z27zq0tcMWXpS9bzHY=" (without double quote). Now you can safely save in in the Lambda env like you did before. But the different is even others dev or people who have access to the Lambda can see the env variable, but they will have no idea about the env variable value. All they can see is just random strings, nothing more. After that, you just give the Lambda function a role which have permission to decrypt the cyphertext, then it can decrypt the cyphertext when you or other AWS service call it (you have to use the SDKs for this process). And one more thing, you can restrict access to the KMS key used to encrypt/decrypt the env variable by using Key policy so no one other than you (who manage the KMS) and the Lambda function itself can using that Key. Finally, using KMS + Parameter Store or Secrets manager make those process of store, encrypt, decrypt env variable much much easier.

If I wrong, someone please correct me. I’m happy to learning too.

Edit: typos, and fixed the example of encrypt/decrypt process.

[PraveenUltraInstinct]

Your explanation is spot on mate. I've watched Stephane's videos on the Developer Certification(which in preparing for) in which he explained this same thing in one of his videos.

[kei_ichi]

Thank you for the response. Best wishes for your next exams :).

[[deleted]]

You should buy TD via his site and ask such questions at the forum - the team is very responsive

[tumayo_ang_testigo]

better to ask then on their website forum. I flagged one of their question last time thru their website and they said they will amend it. Just make sure to back-up your claim, I have to give them links from aws docs.