DEA-C01 Question 306
Select 2You are designing a data processing pipeline where you need to ingest real-time streaming data into Amazon Kinesis Data Streams and process it using AWS Lambda. The Lambda function will transform the data and send the processed records to an Amazon S3 bucket for long-term storage. To ensure the Lambda function processes the records correctly, you need to configure appropriate permissions for API calls. Which of the following steps are required to ensure the pipeline works as intended?
- A
Attach an IAM role to the Lambda function with permissions to read from Kinesis Data Streams and write to the S3 bucket.
- B
Enable data encryption at rest for the Kinesis Data Stream to secure the incoming data.
- C
Configure the S3 bucket policy to allow the Lambda function's IAM role to write objects to the bucket.
- D
Attach an IAM policy to Kinesis Data Streams that allows the Lambda function to invoke itself.
- E
Create a VPC endpoint for the S3 bucket to ensure Lambda can access it securely.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure the pipeline works as intended, the Lambda function must have the correct IAM role permissions to read data from Kinesis Data Streams and write data to the S3 bucket. Additionally, the S3 bucket policy must allow the Lambda function's IAM role to write objects. Other options, such as encryption at rest or a VPC endpoint, are not mandatory for the pipeline's functionality in this specific scenario.
- A. Correct.
Correct. The Lambda function requires an IAM role with permissions to read from the Kinesis Data Stream and write to the S3 bucket to perform the necessary API calls for data processing.
- B. Incorrect.
Incorrect. While encryption at rest is a best practice, it is not directly required for the API calls or to ensure the pipeline works as intended.
- C. Correct.
Correct. The S3 bucket policy must explicitly allow the Lambda function's IAM role to write objects to the bucket. Without this, the write operation will fail due to insufficient permissions.
- D. Incorrect.
Incorrect. Kinesis Data Streams does not require an IAM policy to allow Lambda to invoke itself. Instead, permissions must be configured for the Lambda function to read from Kinesis.
- E. Incorrect.
Incorrect. A VPC endpoint is not required for Lambda to access an S3 bucket unless the Lambda function is deployed inside a VPC without internet access.