DVA-C02 Question 264
Single answerYou are developing a serverless application using AWS Lambda. One of your Lambda functions needs to access a private Amazon S3 bucket to retrieve and process files. How can you securely grant the Lambda function access to the bucket?
- A
Attach an AWS Identity and Access Management (IAM) role with appropriate S3 permissions to the Lambda function.
- B
Store the S3 bucket's access keys in the Lambda function's environment variables.
- C
Manually grant public access to the S3 bucket so the Lambda function can retrieve files.
- D
Embed the S3 bucket's access keys directly in the Lambda function's code.
Show answer and explanation
Correct answer: A
Explanation
The best way to grant a Lambda function access to an S3 bucket is by attaching an IAM role to the function. This eliminates the need for embedding credentials directly in the code or environment variables, ensuring a secure and scalable solution. The role's policy can be configured to grant the least privilege required for the function to perform its tasks, adhering to the principle of least privilege.
- A. Correct.
This is the correct approach. Attaching an IAM role to the Lambda function allows it to securely access the private S3 bucket without exposing credentials. The role contains policies that define the permissions the function has, including access to specific S3 resources.
- B. Incorrect.
This is insecure and not recommended as environment variables can be accessed and potentially exploited if not properly configured or secured.
- C. Incorrect.
Granting public access to an S3 bucket is highly insecure and violates best practices for securing AWS resources.
- D. Incorrect.
Hardcoding access keys in the Lambda function's code is a security risk and goes against AWS best practices. If the code is compromised, the keys could be exposed.