DVA-C02 Question 261
Select 3A developer is building a serverless application using AWS Lambda. The application processes images uploaded to an Amazon S3 bucket and stores metadata in an Amazon DynamoDB table. The developer wants to ensure the Lambda function has the necessary permissions to read from the S3 bucket and write to the DynamoDB table. Which of the following steps should the developer take to grant the correct permissions?
- A
Attach an IAM policy with the required permissions to the Lambda execution role.
- B
Manually configure the Lambda function to access the S3 bucket and DynamoDB table by editing the code.
- C
Use an AWS managed policy that provides S3 read access and DynamoDB write access, and attach it to the Lambda execution role.
- D
Grant public access to the S3 bucket and DynamoDB table to allow the Lambda function to access them.
- E
Create a custom IAM policy with S3 read permissions and DynamoDB write permissions, and attach it to the Lambda execution role.
Show answer and explanation
Correct answers: A, C, E
Explanation
To grant the Lambda function access to the S3 bucket and DynamoDB table, the developer must attach appropriate IAM policies to the Lambda execution role. This can be achieved by attaching either an AWS managed policy or a custom IAM policy that grants the necessary permissions. Granting public access is not secure, and permissions should not be handled within the application code. Following the principle of least privilege ensures security and proper access management.
- A. Correct.
Correct: Attaching an IAM policy with the required permissions to the Lambda execution role is the standard way to grant permissions for AWS services.
- B. Incorrect.
Incorrect: Manually configuring access in the code is not a valid or secure method for granting permissions. Access control should always be handled through IAM policies.
- C. Correct.
Correct: Using an AWS managed policy is a convenient way to grant permissions without creating a custom policy. However, ensure the managed policy fits the required access level.
- D. Incorrect.
Incorrect: Granting public access to the S3 bucket and DynamoDB table is a security risk and violates AWS best practices.
- E. Correct.
Correct: Creating a custom IAM policy allows the developer to define precise permissions for the Lambda function, ensuring it has only the access it needs.