DVA-C02 Question 141
Single answerA development team is building a serverless application using AWS Lambda functions, Amazon S3, and Amazon DynamoDB. They want to ensure that each Lambda function only has the necessary permissions to interact with specific resources (e.g., read data from DynamoDB or write objects to S3). How can the team implement Role-Based Access Control (RBAC) to achieve this?
- A
Create an IAM role for each Lambda function, attach permissions specific to the required resources, and assign the roles to the respective Lambda functions.
- B
Assign a single IAM user to all Lambda functions and attach an administrator policy to the user for full access to all AWS services.
- C
Attach a single IAM role with full access permissions to all Lambda functions for simplicity.
- D
Use resource-based policies on S3 and DynamoDB to allow access to all Lambda functions without attaching any IAM roles.
Show answer and explanation
Correct answer: A
Explanation
To adhere to Role-Based Access Control (RBAC) and the principle of least privilege, it is recommended to create distinct IAM roles for each Lambda function, with permissions scoped narrowly to only the resources and actions required by each function. This ensures that each function has access only to what it needs, reducing the risk of unauthorized access or privilege escalation.
- A. Correct.
Correct. By creating individual IAM roles for each Lambda function and attaching the least privilege permissions required for their specific tasks, the principle of least privilege is enforced, aligning with RBAC best practices.
- B. Incorrect.
Incorrect. Assigning an IAM user to Lambda functions is not recommended as IAM users are intended for individual users, not AWS services. Additionally, granting full access violates the principle of least privilege.
- C. Incorrect.
Incorrect. Using a single role with full access permissions for all Lambda functions exposes unnecessary risk by granting excessive permissions and does not follow RBAC principles.
- D. Incorrect.
Incorrect. Resource-based policies are useful but cannot entirely replace the need for IAM roles in this scenario, as they do not provide the granularity needed for implementing RBAC for Lambda functions.