DVA-C02 Question 122
Single answerYou are developing a serverless application on AWS and need to ensure that your AWS Lambda function can securely access a DynamoDB table. What is the BEST way to grant the Lambda function the required permissions?
- A
Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.
- B
Embed the DynamoDB access credentials directly into the Lambda function code.
- C
Grant public access to the DynamoDB table so the Lambda function can interact with it without restrictions.
- D
Use an AWS Systems Manager Parameter Store to store the DynamoDB credentials and retrieve them in the Lambda function.
Show answer and explanation
Correct answer: A
Explanation
The best practice for granting AWS Lambda functions permissions to access AWS resources is by assigning an IAM role with the necessary permissions. This ensures secure, fine-grained access control without exposing sensitive credentials in the code. Hardcoding credentials, granting public access, or using an external secret store like Parameter Store are not the recommended approaches for this scenario.
- A. Correct.
This is the correct way to grant permissions to a Lambda function. By assigning an IAM role to the Lambda function with the appropriate policy, you ensure secure, least-privilege access to the DynamoDB table without hardcoding credentials.
- B. Incorrect.
Embedding credentials directly into the Lambda function code is insecure and violates best practices for managing secrets. This approach risks exposing credentials if the code is compromised.
- C. Incorrect.
Granting public access to a DynamoDB table is a significant security risk. It exposes the table to unauthorized access and is not recommended for production environments.
- D. Incorrect.
While AWS Systems Manager Parameter Store is useful for storing secrets, it is not needed in this scenario. Lambda's integration with IAM roles allows for secure, credential-free access to AWS resources like DynamoDB.