DVA-C02 Question 241
Single answerA developer is building a serverless application that processes data in real-time using AWS Lambda. The application needs to access an Amazon S3 bucket to store processed data and a DynamoDB table to retrieve configuration settings. What is the best way to grant the Lambda function the required permissions?
- A
Attach an IAM role with the necessary permissions to the Lambda function.
- B
Embed AWS access keys and secret keys directly into the Lambda function code.
- C
Grant public access to the S3 bucket and the DynamoDB table.
- D
Use environment variables in the Lambda function to store the permissions.
Show answer and explanation
Correct answer: A
Explanation
The best practice for granting permissions to a Lambda function is to attach an IAM role with the required policies. This method ensures secure and temporary access to AWS resources, adhering to the principle of least privilege. Other options, such as embedding credentials in the code or granting public access, pose significant security risks and are not recommended.
- A. Correct.
Correct: Attaching an IAM role to the Lambda function is the recommended way to grant permissions securely. The role will provide temporary credentials to the Lambda function and ensure least privilege access.
- B. Incorrect.
Incorrect: Embedding AWS access keys and secret keys in the code is considered a security risk and violates AWS best practices.
- C. Incorrect.
Incorrect: Granting public access to the S3 bucket and DynamoDB table exposes your resources to unauthorized access, which is a major security risk.
- D. Incorrect.
Incorrect: Environment variables are not a mechanism for granting permissions. They are used to store configuration data and sensitive information like database connection strings.