DVA-C02 Question 143
Single answerA company is developing a serverless application using AWS Lambda. The application requires access to an S3 bucket for storing and retrieving files. To follow the principle of least privilege and implement role-based access control (RBAC), how should the developer configure access permissions?
- A
Attach an IAM policy with S3 Full Access to the Lambda function's execution role
- B
Attach an IAM policy to the Lambda function's execution role granting access only to specific S3 bucket actions required by the application
- C
Configure the Lambda function to assume an administrator role with full permissions
- D
Manually configure permissions for the Lambda function in the S3 bucket policy
Show answer and explanation
Correct answer: B
Explanation
To implement role-based access control (RBAC) and follow the principle of least privilege, permissions should be scoped down to only what is necessary for the Lambda function to perform its tasks. Attaching an IAM policy to the Lambda function's execution role that grants access to specific S3 bucket actions is the best practice. This ensures that the Lambda function has minimal permissions required for its operation and avoids over-provisioning access.
- A. Incorrect.
This option violates the principle of least privilege as it grants the Lambda function access to all S3 buckets and actions, not limiting it to the specific bucket and actions required.
- B. Correct.
This is the correct approach because it follows the principle of least privilege by granting only the permissions required for the Lambda function to perform its tasks on the specific S3 bucket.
- C. Incorrect.
This option is incorrect because assigning an administrator role with full permissions goes against the principle of least privilege and unnecessarily expands the function's access.
- D. Incorrect.
While S3 bucket policies can be used to grant access, the recommended approach is to use IAM policies attached to the Lambda function's execution role as it centralizes and simplifies permission management.