DVA-C02 Question 166
Single answerYou are developing a serverless application using AWS Lambda and need to ensure that your function can securely access data stored in an Amazon S3 bucket. The S3 bucket should only allow access to your Lambda function, and no other services or users. How can you achieve this?
- A
Attach an IAM role with S3 access policies to the Lambda function.
- B
Use access keys and secret keys inside the Lambda function's code to authenticate to the S3 bucket.
- C
Configure a bucket policy on the S3 bucket to allow access only from the Lambda function's IAM role.
- D
Manually add the Lambda function's IP address to the S3 bucket's access control list (ACL).
Show answer and explanation
Correct answer: C
Explanation
To securely allow an AWS Lambda function to access an S3 bucket, you should configure a bucket policy that explicitly grants access to the Lambda function's IAM role. This ensures that access is limited to the function itself, without exposing the bucket to other users or services. Avoid using access keys in code or IP-based access controls, as these are less secure and not scalable.
- A. Incorrect.
This is partially correct, but it does not ensure that only the Lambda function can access the bucket. Additional configuration, such as a bucket policy, is needed.
- B. Incorrect.
This is not a recommended practice, as embedding access keys and secret keys in code is a security risk.
- C. Correct.
This is the correct solution. By configuring a bucket policy that explicitly allows access only from the Lambda function's IAM role, you ensure secure and scoped access to the S3 bucket.
- D. Incorrect.
This is incorrect because Lambda functions do not have fixed IP addresses, and relying on IP-based access is not a secure or reliable solution in this scenario.