An Amazon API Gateway API invokes an AWS Lambda function that needs to interact with a software- as-a-service (SaaS) platform. A unique client token is generated in the SaaS platform to grant access…

Question

Options

• AStore the client token as a secret in AWS Secrets Manager. Use th^AWS SDK to retneve the
• BConfigure a token-based Lambda authorizer in API Gateway.
• CStore the client token as a SecureString parameter in AWS Systems Manager Parameter Store.
• DUse AWS Key Management Service (AWS KMS) to encrypt the client token. Pass the token to

• A
  15% (4)
• B
  35% (9)
• C
  42% (11)
• D
  8% (2)

Explanation

AWS Systems Manager Parameter Store with SecureString encrypts the token at rest using AWS KMS, integrates natively with Lambda (retrievable via SDK or environment at runtime), and costs nothing for standard parameters - making it the most cost-effective solution for this use case.

Why the distractors fail:

• A (Secrets Manager) also encrypts secrets and works well technically, but charges ~$0.40/secret/month plus per-API-call fees, making it more expensive than Parameter Store for a single static token.
• B (Lambda authorizer) is a request authentication mechanism for API Gateway clients - it doesn't address storing or encrypting a third-party SaaS access token.
• D (KMS directly) would encrypt the token, but KMS alone provides no storage - you'd still need somewhere to put the ciphertext, and you'd have to manage decryption manually, adding complexity without solving the storage requirement elegantly.

Memory tip: Think of it as a cost ladder - Parameter Store (free tier) < Secrets Manager (paid). When a question says "most cost-effectively" and involves a single credential that doesn't need rotation, Parameter Store SecureString is almost always the answer over Secrets Manager.

No community discussion yet for this question.