Sensitive Data Management

• Never hard-code a secret: externalize it and fetch it at runtime by IAM role
• Lambda env vars are encrypted at rest but are still the wrong home for credentials
• Lambda's environment variables share a 4 KB total size cap
• Reach for Secrets Manager when you need rotation or a value over 8 KB
• Parameter Store SecureString gives KMS-encrypted storage with no per-secret charge
• Advanced parameters add policies (including expiration) that Standard lacks
• Use a String parameter or env var for non-secret config, not a per-secret store
• Secrets Manager managed rotation needs no Lambda for its supported databases
• Off the managed list, you supply a rotation Lambda implementing the four-step contract
• Fetch the secret per use so the app picks up the rotated value
• Classify data first so controls match its sensitivity
• Scrub secrets and PII before they reach any log, metric, or trace
• Use Amazon Macie to inventory PII in S3, and only in S3
• Macie publishes findings to Security Hub directly, in ASFF format
• Configuring a customer managed key on a Lambda function needs kms:CreateGrant and kms:Encrypt (plus kms:ListAliases for the console)
• Deny kms:Decrypt on the function's CMK to hide Lambda env-var values while still allowing management
• Lambda 'encryption helpers' add client-side encryption in transit and need kms:Decrypt at runtime
• Use the alternating users rotation strategy for zero-downtime credential rotation
• Cache secrets with the Secrets Manager client-side caching library, initialized outside the handler
• A rotation Lambda in a no-internet VPC needs a Secrets Manager interface VPC endpoint
• Reading a CMK-encrypted secret requires both secretsmanager:GetSecretValue and kms:Decrypt
• Retrieving a SecureString parameter uses WithDecryption=true and needs kms:Decrypt on a CMK

Unlock with Premium — includes all practice exams and the complete study guide.