A payments Lambda function stores an API token in an environment variable inside its CloudFormation template. The token must be removed from the template, and the function must still read it at runtime. What should change?
Select an answer to reveal the explanation.
Short Explanation
Leaving a spare key in the welcome packet means everyone who receives the packet can copy it. You move the token to Secrets Manager, take it out of the template, and let the function read it with GetSecretValue. Encrypting the template file or copying the value into a stack output still leaves the secret where the stack stores it.
Full Explanation
An environment variable in the template is stored with the function configuration, so anyone who can read that configuration can read the token. Secrets Manager holds the token outside the template. Removing it from the template takes it out of the stack, and secretsmanager:GetSecretValue on the function's role lets the function retrieve the current value at runtime. Encrypting a local copy of the template does not change the fact that the token remains an environment variable in the deployed function. Reserved concurrency limits how many executions run at once. It is not a secret store, and it cannot hold the token. A stack output is visible on the stack and would still require the token to be present in the template to be exported. Caveat: the function code must call Secrets Manager, or it will keep looking for an environment variable that was removed. Operational check: confirm the template no longer contains the token, invoke the function, and see a successful GetSecretValue in the function logs.