DVA-C02 Question 149
Single answerYou are developing an application that uses AWS Lambda to process data from an Amazon S3 bucket. The Lambda function needs to read objects from the bucket but should not have permissions to delete or modify the objects. Following the principle of least privilege, how should you configure the IAM policy attached to the Lambda function?
- A
Attach the 'AmazonS3ReadOnlyAccess' managed policy to the Lambda function's IAM role.
- B
Create a policy that grants 's3:*' permissions for the specific bucket and attach it to the Lambda function's IAM role.
- C
Create a policy that grants 's3:GetObject' permission for the specific bucket and attach it to the Lambda function's IAM role.
- D
Attach the 'AdministratorAccess' managed policy to the Lambda function's IAM role to ensure it has all required permissions.
Show answer and explanation
Correct answer: C
Explanation
The principle of least privilege dictates that resources and users should only have the permissions they need to perform their tasks. In this scenario, the Lambda function only needs to read objects from a specific S3 bucket. Granting the 's3:GetObject' permission for the specific bucket ensures the function has the required access while minimizing unnecessary permissions.
- A. Incorrect.
This option grants read-only access to all S3 buckets, not just the specific bucket. While it avoids modification or deletion actions, it does not adhere to the principle of least privilege because it grants more permissions than necessary.
- B. Incorrect.
This option grants full access to all S3 actions ('s3:*') for the specified bucket, which includes permissions to delete and modify objects. This violates the principle of least privilege.
- C. Correct.
This option grants only the 's3:GetObject' permission for the specific bucket, which is sufficient for reading objects and adheres to the principle of least privilege.
- D. Incorrect.
Granting 'AdministratorAccess' provides the Lambda function with full access to all AWS services and resources. This is overly permissive and a violation of the principle of least privilege.