DOP-C02 Question 356
Single answerAn organization is building a serverless application on AWS that processes customer data and sends notifications. The application uses an Amazon SQS queue to decouple components and is triggered by AWS Lambda functions. The organization wants to ensure the Lambda functions have appropriate permissions to access the SQS queue while adhering to the principle of least privilege. How should the organization configure IAM entities to achieve this goal?
- A
Attach an IAM policy directly to the Lambda functions granting access to the SQS queue.
- B
Create an IAM role with a policy granting access to the SQS queue, and associate the role with the Lambda functions.
- C
Use an IAM group with a policy granting access to the SQS queue and add the Lambda functions to the group.
- D
Attach a resource-based policy to the SQS queue granting access specifically to the Lambda functions.
Show answer and explanation
Correct answer: B
Explanation
The appropriate way to grant permissions for AWS services like Lambda is by using IAM roles. Lambda functions assume these roles to gain temporary credentials for accessing other AWS services, such as SQS. This approach aligns with the principle of least privilege by ensuring that the permissions are scoped specifically to what the Lambda function needs. IAM groups are used for human users, not AWS services, and attaching resource-based policies to SQS queues is a less preferred solution in this scenario.
- A. Incorrect.
This option is incorrect because Lambda functions cannot have policies directly attached to them. Instead, they assume IAM roles for permissions.
- B. Correct.
This is the correct answer. Using an IAM role with a policy granting least-privilege access to the SQS queue and associating it with the Lambda functions is the recommended approach. Lambda functions assume the role to gain temporary credentials for accessing the queue.
- C. Incorrect.
This is incorrect because IAM groups are used to manage permissions for human users, not AWS services like Lambda.
- D. Incorrect.
This is incorrect because while resource-based policies can be used to grant access to specific resources, the recommended approach for Lambda functions is to use an IAM role with appropriate permissions.