Database passwords for the permits API were pasted into plaintext Lambda environment variables that broad IAM roles can read in the console. What is the preferred remediation?
Select an answer to reveal the explanation.
Short Explanation
A password sitting in a plaintext Lambda env var is a sticky note on the monitor — anyone with console rights can read it. Pull secrets from Secrets Manager (or encrypted parameters), not cleartext env configuration.
Full Explanation
Sensitive credentials should not live as plaintext Lambda environment variables visible to broad console roles. Prefer AWS Secrets Manager or SSM Parameter Store SecureString with runtime retrieval; KMS encryption of environment variables is a lesser improvement still better than plaintext. Base64 is encoding, not encryption. Renaming or widening IAM access does not remediate secret exposure.