DVA-C02 Question 210
Single answerYou are developing a serverless application using AWS Lambda, which needs to interact with an Amazon S3 bucket. How can you securely provide the required credentials for the Lambda function to access the S3 bucket?
- A
Embed the AWS access key and secret key directly in the Lambda function code.
- B
Store the credentials in the Lambda function's environment variables.
- C
Attach an IAM role with appropriate permissions to the Lambda function.
- D
Pass the credentials to the Lambda function via an API Gateway request.
Show answer and explanation
Correct answer: C
Explanation
The best practice for securely handling credentials in AWS Lambda is to attach an IAM role with the necessary permissions. This approach eliminates the need to hard-code or store credentials in the function, reducing the risk of accidental exposure or compromise. The Lambda service assumes the role and retrieves temporary credentials to interact with AWS resources securely.
- A. Incorrect.
Embedding AWS access keys and secret keys directly in the Lambda function code is a bad practice as it exposes sensitive credentials, making them vulnerable to security breaches.
- B. Incorrect.
Storing credentials in environment variables is slightly better, but it is still not a recommended best practice. Credentials could potentially be exposed if the environment variables are compromised.
- C. Correct.
Attaching an IAM role with appropriate permissions to the Lambda function is the secure and recommended way to grant access to AWS resources, as the function automatically assumes the role to obtain temporary credentials.
- D. Incorrect.
Passing credentials via an API Gateway request is insecure and not a recommended approach because it exposes sensitive information in transit.