DVA-C02 Question 280
Single answerYou are developing a serverless application on AWS that processes data in real-time using AWS Lambda. The application requires access to an Amazon S3 bucket to fetch input data and write processed results. What is the most secure way to grant your Lambda function access to the S3 bucket?
- A
Attach an AWS Identity and Access Management (IAM) role with necessary permissions to the Lambda function.
- B
Hardcode the S3 bucket credentials directly into the Lambda function code.
- C
Store the S3 bucket credentials in an encrypted file and load them in the Lambda function at runtime.
- D
Manually configure the Lambda function to use the S3 bucket access policy.
Show answer and explanation
Correct answer: A
Explanation
The correct approach to securely provide a Lambda function access to an S3 bucket is by attaching an IAM role with the appropriate permissions. This allows AWS to manage temporary credentials securely and ensures adherence to the principle of least privilege. Other methods, such as hardcoding credentials or manually configuring access policies, are either insecure or unsupported.
- A. Correct.
Attaching an IAM role with the necessary permissions to the Lambda function is the most secure and recommended way to provide access to AWS services. The role will automatically handle temporary credentials for the function.
- B. Incorrect.
Hardcoding credentials directly into the Lambda function code is highly insecure and violates AWS security best practices, as it risks exposing the credentials accidentally.
- C. Incorrect.
Storing credentials in an encrypted file and loading them at runtime introduces unnecessary complexity and is less secure than using IAM roles. It also requires additional management for encryption and decryption.
- D. Incorrect.
Lambda functions do not support direct use of S3 bucket access policies. Instead, permissions should be managed through IAM roles or policies.