DVA-C02 Question 158
Single answerA company is building a serverless web application using AWS Lambda, API Gateway, and DynamoDB. They want to ensure that the Lambda function has access to the DynamoDB table but restrict access to only specific actions such as reading and writing data. What is the recommended way to achieve this?
- A
Attach a managed policy with full DynamoDB access to the Lambda function's IAM role.
- B
Create an inline policy for the Lambda function's IAM role, granting specific read and write permissions to the DynamoDB table.
- C
Assign the AdministratorAccess policy to the Lambda function's IAM role to ensure it has all the required permissions.
- D
Create a resource-based policy on the DynamoDB table to allow access from the Lambda function.
Show answer and explanation
Correct answer: B
Explanation
To secure access to services in AWS, it is best practice to use the principle of least privilege. In this scenario, the Lambda function's IAM role should have an inline policy granting only the necessary read and write permissions to the DynamoDB table. Managed policies like full DynamoDB access or AdministratorAccess are overly permissive and not recommended. Resource-based policies are not applicable in this case.
- A. Incorrect.
This option grants more permissions than needed (full access) and violates the principle of least privilege. It is not the recommended approach.
- B. Correct.
This is the correct approach as it follows the principle of least privilege by granting only the required permissions (read and write) to the specific DynamoDB table.
- C. Incorrect.
Assigning AdministratorAccess policy grants excessive permissions beyond just DynamoDB access, which is unnecessary and a security risk.
- D. Incorrect.
Resource-based policies on DynamoDB tables are not used to define application-level access control. Instead, IAM roles and policies should be utilized for Lambda.