DVA-C02 Question 212
Single answerA developer is building a serverless application on AWS that requires access to an Amazon S3 bucket to store log files. The application is deployed using AWS Lambda. What is the MOST secure way for the developer to provide the Lambda function access to the S3 bucket?
- A
Embed the AWS access key ID and secret access key in the Lambda function's code.
- B
Store the AWS access key ID and secret access key in an encrypted file and upload it to the Lambda function.
- C
Create an IAM role with permissions to access the S3 bucket and assign it to the Lambda function.
- D
Use environment variables in the Lambda function to store the AWS access key ID and secret access key.
Show answer and explanation
Correct answer: C
Explanation
The most secure way to handle credentials for AWS Lambda functions is by using IAM roles. When you assign an IAM role to a Lambda function, AWS automatically provides temporary credentials to the function when it executes, eliminating the need for hardcoding or manually managing credentials. This approach adheres to the principle of least privilege and ensures secure access to AWS resources.
- A. Incorrect.
Embedding access keys in the code is highly insecure because it risks exposing your credentials if the code is accessed or compromised. It is against AWS security best practices.
- B. Incorrect.
While encrypting credentials and uploading them is slightly more secure than embedding them in code, it still requires managing keys manually and increases the risk of exposure. This approach is not recommended.
- C. Correct.
Assigning an IAM role to the Lambda function is the most secure and recommended approach. The Lambda function will automatically assume the role and retrieve temporary credentials to access the S3 bucket without requiring hardcoded credentials.
- D. Incorrect.
Storing credentials in environment variables is insecure because anyone with access to the Lambda function's configuration could potentially view and misuse them. It is not a best practice for secure credential handling.