DVA-C02 Question 140
Select 2You are developing a serverless application using AWS Lambda and Amazon S3. Your Lambda function needs to read and write objects to an S3 bucket named 'example-bucket'. The security team mandates that access permissions must follow the principle of least privilege. Which of the following approaches ensure the Lambda function has the required access while adhering to the security guidelines?
- A
Attach an IAM role to the Lambda function with an inline policy granting 's3:GetObject' and 's3:PutObject' permissions for the 'example-bucket'.
- B
Attach a resource-based policy to the 'example-bucket' granting the Lambda function access to 's3:GetObject' and 's3:PutObject'.
- C
Attach a service control policy (SCP) to your AWS account allowing all S3 actions for the Lambda service.
- D
Attach an IAM role to the Lambda function with a managed policy granting 's3:*' permissions for all buckets in the account.
- E
Attach both an IAM role with specific permissions to the Lambda function and a resource-based policy to the 'example-bucket' to restrict access.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure the Lambda function has access to the required S3 bucket while adhering to the principle of least privilege, you can use an IAM role with an inline policy specifying 's3:GetObject' and 's3:PutObject' permissions for the 'example-bucket'. Alternatively, you can attach a resource-based policy to the bucket, explicitly allowing the Lambda function to perform these actions. Both of these approaches align with AWS security best practices. However, using overly permissive policies, such as 's3:*' or SCPs, violates the principle of least privilege and is not recommended.
- A. Correct.
Correct. Attaching an IAM role with an inline policy to the Lambda function is a recommended way to provide it with specific permissions. This ensures that the Lambda function has the necessary access to the 'example-bucket' while adhering to the principle of least privilege.
- B. Correct.
Correct. A resource-based policy on the bucket can grant access to the Lambda function without requiring overly permissive IAM role permissions. This ensures that access is limited to the specific bucket.
- C. Incorrect.
Incorrect. Service control policies (SCPs) are used to define permissions at the account or organizational level. They are not suitable for defining permissions for a specific resource such as an S3 bucket.
- D. Incorrect.
Incorrect. Granting 's3:*' permissions to all buckets in the account violates the principle of least privilege. This option provides excessive permissions and is not recommended.
- E. Incorrect.
Incorrect. Attaching both an IAM role and a resource-based policy is redundant when either method alone can provide the necessary permissions while maintaining security best practices.