DVA-C02 Question 118
Single answerYou are developing a serverless application using AWS Lambda that requires secure access to a DynamoDB table. The application should only allow the Lambda function to perform read and write operations on the table. How should you implement authentication and authorization to meet this requirement?
- A
Attach an IAM role to the Lambda function with permissions to perform read and write operations on the DynamoDB table.
- B
Use an API Gateway to generate temporary credentials for the Lambda function to access the DynamoDB table.
- C
Embed AWS credentials directly in the Lambda function code for accessing the DynamoDB table.
- D
Grant public access to the DynamoDB table and use a Lambda function to control access programmatically.
Show answer and explanation
Correct answer: A
Explanation
To implement secure authentication and authorization for a Lambda function accessing a DynamoDB table, you should use an IAM role with the necessary permissions. The IAM role should have a policy that allows the specific actions (read and write) on the table. This approach ensures that the Lambda function automatically assumes the role during execution and follows AWS best practices for security and least privilege.
- A. Correct.
Correct: Attaching an IAM role to the Lambda function with the required permissions ensures secure and least-privileged access to the DynamoDB table.
- B. Incorrect.
Incorrect: API Gateway does not generate credentials for Lambda functions. API Gateway is typically used for exposing APIs to clients and managing access to those APIs.
- C. Incorrect.
Incorrect: Embedding AWS credentials directly in the Lambda function code is a security anti-pattern and violates best practices.
- D. Incorrect.
Incorrect: Granting public access to the DynamoDB table poses a significant security risk and violates the principle of least privilege.