DVA-C02 Question 263
Single answerA development team is designing a serverless application using AWS Lambda to process data uploaded to an S3 bucket. The Lambda function needs access to the S3 bucket and must only have permissions required for this specific task. Which is the BEST approach to grant these permissions?
- A
Attach a policy to the Lambda function's IAM role granting full access to all S3 buckets.
- B
Create an inline policy for the Lambda function's IAM role granting permissions to the specific S3 bucket.
- C
Attach the AmazonS3FullAccess managed policy to the Lambda function's IAM role.
- D
Grant permissions to the specific S3 bucket by embedding the policy within the Lambda function code.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege is a fundamental security practice in AWS, requiring services to operate with only the permissions necessary to perform their tasks. Attaching an inline policy to the Lambda function's IAM role, specifying access to the required S3 bucket, satisfies this principle while securely granting the necessary permissions. Other options either grant excessive permissions or are not valid methods of assigning access.
- A. Incorrect.
This grants unnecessary and overly broad permissions, violating the principle of least privilege.
- B. Correct.
This is the correct approach. Creating an inline policy with precise permissions for the specific S3 bucket ensures the Lambda function operates with least privilege.
- C. Incorrect.
The AmazonS3FullAccess managed policy grants access to all S3 buckets, which is excessive and unnecessary for this scenario.
- D. Incorrect.
Embedding a policy within the Lambda function code is not a valid or secure way to grant permissions in AWS.