DVA-C02 Question 209
Single answerYou are developing a serverless application on AWS using AWS Lambda. The function needs to access an Amazon S3 bucket to read and write data. How can you securely handle the credentials required to access the S3 bucket?
- A
Embed the access key and secret key for the S3 bucket in the Lambda function's code.
- B
Use an IAM role with appropriate permissions and attach it to the Lambda function.
- C
Store the access key and secret key in an Amazon S3 bucket and retrieve them during execution.
- D
Pass the access key and secret key as environment variables to the Lambda function.
Show answer and explanation
Correct answer: B
Explanation
The most secure way to handle credentials for AWS services is to use IAM roles. By attaching an IAM role with appropriate permissions to the Lambda function, AWS automatically provides temporary credentials for the function, eliminating the need for hardcoded or manually managed credentials. This aligns with AWS best practices for secure credential handling.
- A. Incorrect.
Embedding credentials directly in the code is a bad practice as it poses a significant security risk. Anyone with access to the code can extract the credentials.
- B. Correct.
Using an IAM role with appropriate permissions and attaching it to the Lambda function is the recommended and most secure way to grant access to AWS resources. The role provides temporary credentials that are rotated automatically.
- C. Incorrect.
Storing credentials in an S3 bucket and retrieving them during execution is insecure. If the bucket permissions are not configured properly, it could lead to unauthorized access. Additionally, this approach does not follow AWS best practices for credential management.
- D. Incorrect.
Passing credentials as environment variables is slightly better than embedding them in code but still insecure. If environment variables are exposed or logged improperly, the credentials could be compromised. It also requires manual management of credential rotation.