DVA-C02 Question 211
Single answerYou are developing a serverless application using AWS Lambda. The application requires access to an Amazon S3 bucket to store user-uploaded files. How should you handle the credentials securely to allow the Lambda function to access the S3 bucket?
- A
Store the AWS credentials directly in the Lambda function's environment variables.
- B
Assign an IAM role with the necessary permissions to the Lambda function.
- C
Hard-code the AWS access and secret keys within the Lambda function's source code.
- D
Use AWS Secrets Manager to store the credentials and retrieve them in the Lambda function at runtime.
Show answer and explanation
Correct answer: B
Explanation
The best practice for secure credential handling in AWS is to use IAM roles. Assigning an IAM role with the necessary permissions to the Lambda function ensures that the function can securely access the required AWS resources without the need to manage or store credentials manually. This approach leverages temporary credentials and enforces the principle of least privilege.
- A. Incorrect.
Storing AWS credentials in environment variables is not secure because environment variables can be exposed and do not provide the principle of least privilege.
- B. Correct.
Assigning an IAM role to the Lambda function is the recommended and secure way to provide access to AWS resources. The role automatically provides temporary credentials, eliminating the need to store or manage long-term credentials.
- C. Incorrect.
Hard-coding credentials in the source code is highly insecure as it can lead to credential leakage if the code is shared or exposed.
- D. Incorrect.
While AWS Secrets Manager is a secure way to store secrets, it is not required in this scenario because using an IAM role is a better and more direct approach for providing access to the S3 bucket.