DVA-C02 Question 115
Single answerA developer is creating a serverless application using AWS Lambda. The Lambda function will need to access an Amazon DynamoDB table and write logs to Amazon CloudWatch Logs. What is the most secure way to configure the Lambda function to access these resources?
- A
Attach a managed policy with full access to all services directly to the Lambda function.
- B
Create an IAM role with specific permissions for DynamoDB and CloudWatch Logs, and assign the role to the Lambda function.
- C
Embed AWS access keys in the Lambda function code to access the required resources.
- D
Grant public access to the DynamoDB table and CloudWatch Logs to allow the Lambda function to access them.
Show answer and explanation
Correct answer: B
Explanation
The most secure way to allow a Lambda function to access AWS resources is to create an IAM role with the minimal permissions required for the task and associate the role with the Lambda function. This approach adheres to the principle of least privilege and ensures secure access without embedding sensitive information like access keys or exposing resources to the public.
- A. Incorrect.
Attaching a managed policy with full access to all services is not secure because it provides excessive permissions and violates the principle of least privilege.
- B. Correct.
Creating an IAM role with specific permissions for DynamoDB and CloudWatch Logs, and assigning it to the Lambda function, is the most secure option. This follows the principle of least privilege and avoids hardcoding credentials.
- C. Incorrect.
Embedding AWS access keys in the Lambda function code is a bad practice because it poses severe security risks, such as accidental exposure of credentials.
- D. Incorrect.
Granting public access to the DynamoDB table and CloudWatch Logs is not secure and exposes these resources to unauthorized access.