# AWS Lambda and Confluent Credentials

**URL:** <https://forum.confluent.io/t/aws-lambda-and-confluent-credentials/5907>\
**Category:** Confluent Cloud\
**Created:** [28 August 2022 20:51 UTC](https://forum.confluent.io/t/aws-lambda-and-confluent-credentials/5907 "2022-08-28T20:51:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![krisrr3](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/krisrr3/32/1741_2.png) [@krisrr3](https://forum.confluent.io/u/krisrr3)\
**Post date:** [28 August 2022 20:51 UTC](https://forum.confluent.io/t/aws-lambda-and-confluent-credentials/5907/1 "2022-08-28T20:51:05Z")

</div>

Hi all,

I have developing an AWS lambda which I am testing locally, by loading a kafka.properties file and the credentials for the Dev Environment.

The one below if the most important one.

```auto
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username='xxxxxxxxxx' password='xxxxxxxxxxxxxx';

```

Could you please let me know how to should these properties be loaded in production. Is there a recommended approach to securely store and deploy this property or property file.

Cheers  
Kris

---

<div class="post-metadata">

**Author:** ![brett](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/brett/32/453_2.png) [@brett](https://forum.confluent.io/u/brett)\
**Post date:** [28 August 2022 21:45 UTC](https://forum.confluent.io/t/aws-lambda-and-confluent-credentials/5907/2 "2022-08-28T21:45:04Z")

</div>

Hi Kris. A few options to consider:

- Any secret store you are already using or have access to e.g. in a containerised environment.
- AWS Secret Manager [Credential password secrets management - AWS Secrets Manager - Amazon Web Services](https://aws.amazon.com/secrets-manager/)
- Switch to OIDC/OAuth2.

In the case of the first two, you’d construct that property from a template, incorporating the secret, and pass it to your client properties.

For OIDC/OAuth2, this is now available in Limited Availability in Confluent Cloud, so contact Support if you need access. See [Configure clients for Confluent Cloud OAuth | Confluent Documentation](https://docs.confluent.io/cloud/current/access-management/authenticate/oauth/configure-clients-oauth.html) for alternate client properties. You’ll need an identity provider configured in your Confluent Cloud account.

Best  
Brett

---

<div class="post-metadata">

**Author:** ![krisrr3](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/krisrr3/32/1741_2.png) [@krisrr3](https://forum.confluent.io/u/krisrr3)\
**Post date:** [29 August 2022 07:15 UTC](https://forum.confluent.io/t/aws-lambda-and-confluent-credentials/5907/3 "2022-08-29T07:15:18Z")

</div>

thanks Brett, much appreciated. Will look into SSM.

---

<div class="post-metadata">

**Author:** ![georgelza](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/georgelza/32/3026_2.png) [@georgelza](https://forum.confluent.io/u/georgelza)\
**Post date:** [15 June 2023 05:23 UTC](https://forum.confluent.io/t/aws-lambda-and-confluent-credentials/5907/4 "2023-06-15T05:23:46Z")

</div>

Krisrr3,  
curious, are a publisher or consumer on the topics.  
looking for some examples of Lambda writing to Confluent Cloud Topics, if you can assist.  
G