DVA-C02 Question 244
Single answerYou are developing a serverless application using AWS Lambda. The application requires temporary access to an Amazon S3 bucket to read and write data. Which of the following is the MOST secure way to grant this access?
- A
Hardcode the S3 bucket credentials in the Lambda function's environment variables.
- B
Attach an inline policy with S3 access permissions directly to the Lambda function.
- C
Use AWS Identity and Access Management (IAM) roles to grant the Lambda function access to the S3 bucket.
- D
Manually generate temporary security credentials and pass them to the Lambda function at runtime.
Show answer and explanation
Correct answer: C
Explanation
The best practice for granting AWS Lambda access to other AWS resources is to use IAM roles. When you assign an IAM role to a Lambda function, AWS automatically handles the creation and rotation of temporary credentials for accessing the specified resources. This approach ensures security, scalability, and compliance with AWS's principle of least privilege.
- A. Incorrect.
Hardcoding credentials in environment variables is not secure and violates AWS best practices. If the environment variables are leaked, the credentials could be compromised.
- B. Incorrect.
Attaching an inline policy directly to the Lambda function is not recommended because it is less flexible and not aligned with AWS best practices. IAM roles should be used instead.
- C. Correct.
Using IAM roles to grant the Lambda function access is the most secure and recommended way. IAM roles allow you to assign temporary credentials automatically and enforce the principle of least privilege.
- D. Incorrect.
Manually generating temporary credentials is error-prone and not scalable. AWS provides built-in mechanisms like IAM roles for such use cases, which are more secure and easier to maintain.