DVA-C02 Question 152
Single answerYou are developing a serverless application on AWS and have created an AWS Lambda function that needs to read objects from an Amazon S3 bucket. According to the principle of least privilege, how should you configure access permissions?
- A
Attach the AmazonS3FullAccess policy directly to the Lambda function's execution role.
- B
Create a custom IAM policy that grants read access to the specific S3 bucket and attach it to the Lambda function's execution role.
- C
Attach the AdministratorAccess policy to the IAM user who deployed the Lambda function.
- D
Grant public read access to the S3 bucket via a bucket policy and remove any IAM role permissions for the Lambda function.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege dictates that you should only grant the permissions necessary to perform a specific task. By creating a custom IAM policy with read permissions for the specific S3 bucket and attaching it to the Lambda function's execution role, you ensure that the Lambda function has the minimum required permissions without exposing excessive access or introducing security risks.
- A. Incorrect.
This option violates the principle of least privilege because the AmazonS3FullAccess policy grants full access to all S3 buckets, which is excessive for this use case.
- B. Correct.
This option aligns with the principle of least privilege as it grants the Lambda function only the specific permissions it needs to read from the designated S3 bucket.
- C. Incorrect.
This option is incorrect because granting AdministratorAccess to the IAM user is a broad and unnecessary permission for this scenario. It also does not directly affect the Lambda function's permissions.
- D. Incorrect.
This option violates security best practices and the principle of least privilege as it makes the S3 bucket publicly accessible, which is unnecessary and insecure.