A Lambda-backed civic chatbot needs a third-party API token. Which approach best matches foundational guidance on where to keep that secret?
Select an answer to reveal the explanation.
Short Explanation
API tokens are keys to someone else's castle — do not leave them lying in source code or casual plaintext dumps. Drop them in Secrets Manager and let the function retrieve them when it runs.
Full Explanation
Secrets such as API tokens should be stored in a secrets management service like AWS Secrets Manager (or similarly appropriate secure parameter mechanisms) rather than hard-coded in application source. This supports access control, auditing, and rotation. Embedding secrets in code or public artifacts is a common anti-pattern tested at CLF depth.