DVA-C02 Question 139
Select 3A developer is working on a serverless application that uses AWS Lambda to process data stored in an S3 bucket. The developer needs to ensure that the Lambda function has the necessary permissions to read objects from the bucket. Which of the following approaches should the developer use to grant the required access?
- A
Attach a resource-based policy to the S3 bucket allowing the Lambda function to read objects.
- B
Attach an inline policy to the Lambda function's execution role granting it permission to read objects from the S3 bucket.
- C
Create a service control policy (SCP) allowing access to the S3 bucket and attach it to the Lambda function.
- D
Use a bucket policy to explicitly deny access to all users except the Lambda function's execution role.
- E
Attach a managed policy to the Lambda function's execution role that grants permission to read objects from the S3 bucket.
Show answer and explanation
Correct answers: A, B, E
Explanation
To grant a Lambda function permission to access an S3 bucket, you can use either a resource-based policy on the S3 bucket, an inline policy on the Lambda function's execution role, or a managed policy attached to that role. Service control policies (SCPs) are not applicable to this scenario as they are used for account-level permission boundaries within AWS Organizations. Explicitly denying access using a bucket policy is overly restrictive and not recommended unless specifically addressing a security concern.
- A. Correct.
Correct: Attaching a resource-based policy to the S3 bucket can grant the Lambda function permission to access the bucket. Resource-based policies are commonly used to grant cross-account or specific entity access.
- B. Correct.
Correct: Inline policies attached to the Lambda function's execution role can grant it access to the S3 bucket. These are identity-based policies specific to the role.
- C. Incorrect.
Incorrect: Service control policies (SCPs) are used to set permissions boundaries at the AWS Organizations level and do not apply directly to individual Lambda functions or S3 buckets.
- D. Incorrect.
Incorrect: While a bucket policy can be used to restrict access, explicitly denying access to all users except the Lambda function is unnecessarily restrictive and not a best practice for this scenario.
- E. Correct.
Correct: A managed policy containing the required permissions can be attached to the Lambda function's execution role, granting it access to the S3 bucket.