DVA-C02 Question 151
Select 1You are developing a serverless application using AWS Lambda. Your function needs to read data from an S3 bucket and write logs to a DynamoDB table. According to the principle of least privilege, which of the following IAM policy configurations should you apply to the Lambda function's execution role?
- A
Grant the Lambda execution role 'AmazonS3ReadOnlyAccess' and 'AmazonDynamoDBFullAccess' managed policies.
- B
Create a custom policy that grants 's3:GetObject' access to the specific S3 bucket and 'dynamodb:PutItem' access to the specific DynamoDB table.
- C
Attach the 'AdministratorAccess' policy to the Lambda execution role.
- D
Grant the Lambda execution role 'AmazonS3FullAccess' and 'AmazonDynamoDBFullAccess' managed policies.
- E
Create a custom policy that grants 's3:*' access to all S3 buckets and 'dynamodb:PutItem' access to the specific DynamoDB table.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege dictates that you should grant the minimum permissions necessary for a resource to perform its required tasks. In this case, the Lambda function only needs to read objects from a specific S3 bucket and write logs to a specific DynamoDB table. Creating a custom policy with 's3:GetObject' and 'dynamodb:PutItem' for the specific resources ensures that the function has only the permissions it requires, without granting excessive or unnecessary access.
- A. Incorrect.
Granting 'AmazonS3ReadOnlyAccess' and 'AmazonDynamoDBFullAccess' would provide unnecessary permissions like full write access to DynamoDB and read access to all S3 buckets, which violates the principle of least privilege.
- B. Correct.
Creating a custom policy to grant 's3:GetObject' for a specific bucket and 'dynamodb:PutItem' for a specific table adheres to the principle of least privilege, as it provides only the specific permissions required for the task.
- C. Incorrect.
Attaching the 'AdministratorAccess' policy would grant excessive permissions that are not required for the Lambda function, violating the principle of least privilege.
- D. Incorrect.
Granting 'AmazonS3FullAccess' and 'AmazonDynamoDBFullAccess' provides overly broad permissions, including write access to all S3 buckets and read/write access to all DynamoDB tables, violating the principle of least privilege.
- E. Incorrect.
Creating a custom policy with 's3:*' for all buckets violates the principle of least privilege by allowing excessive permissions. While the 'dynamodb:PutItem' permission is correctly scoped, the S3 permissions are overly broad.