Feature flags and non-secret DynamoDB table names for a grants Lambda should change per stage without rebuilding the deployment package each time. Where should that configuration live?
Select an answer to reveal the explanation.
Short Explanation
Think of env vars as the sticky notes on the function's desk—swap the stage without reprinting the whole manual. Table names and feature flags belong there; real secrets still go in Secrets Manager. Hard-coding in source, passwords in Git, or baking flags into layers makes every config tweak a rebuild.
Full Explanation
Lambda environment variables are the standard place for per-stage non-secret configuration such as table names and feature flags, avoiding package rebuilds for simple config changes. Secrets should remain in Secrets Manager or similar KMS-backed stores. Hard-coding in source, committing passwords, or forcing layer churn for routine flags adds friction and risk.