DVA-C02 Question 168
Single answerA developer is building a serverless application using AWS Lambda. The application requires connecting to an Amazon DynamoDB table to fetch user data. To ensure secure access, the developer wants to avoid hardcoding credentials in the application code. What is the recommended approach to achieve this?
- A
Attach an IAM role with appropriate permissions to the Lambda function.
- B
Store the access key and secret key in the Lambda environment variables.
- C
Encrypt the credentials using AWS KMS and store them in the code.
- D
Use a dedicated EC2 instance to fetch data from DynamoDB and pass it to the Lambda function.
Show answer and explanation
Correct answer: A
Explanation
The recommended approach for providing secure access to AWS resources in a serverless application is to use IAM roles. By attaching an IAM role to the Lambda function, the function assumes the role and gets temporary security credentials to access the required resources, such as DynamoDB. This approach eliminates the need for hardcoding credentials, ensuring better security and adherence to AWS best practices.
- A. Correct.
This is the correct approach. By attaching an IAM role with appropriate permissions to the Lambda function, the function can securely access the DynamoDB table without hardcoding credentials.
- B. Incorrect.
Storing credentials in the Lambda environment variables is not secure. It exposes sensitive data and is not a best practice.
- C. Incorrect.
Encrypting credentials with AWS KMS and storing them in the code still requires managing keys and does not align with recommended security practices for serverless applications.
- D. Incorrect.
Using a dedicated EC2 instance to fetch data adds unnecessary complexity, cost, and management overhead to the serverless architecture.