DVA-C02 Question 281
Single answerYou are developing a serverless application using AWS Lambda and need to ensure that your function has access to a DynamoDB table to store and retrieve data. Which of the following is the MOST secure way to grant your Lambda function access to the DynamoDB table?
- A
Embed the DynamoDB credentials directly in the Lambda function's code.
- B
Assign an IAM role to the Lambda function with permissions to access the DynamoDB table.
- C
Use hardcoded environment variables in the Lambda function to store the DynamoDB credentials.
- D
Create a user with programmatic access in IAM and pass the access keys to the Lambda function.
Show answer and explanation
Correct answer: B
Explanation
The correct approach is to assign an IAM role to the Lambda function with the necessary permissions to access the DynamoDB table. This method ensures access is controlled via AWS IAM, follows the principle of least privilege, and avoids the risks associated with hardcoding or exposing credentials. AWS Lambda automatically assumes the IAM role and uses temporary credentials to access the specified resources securely.
- A. Incorrect.
Embedding credentials in the Lambda function's code is insecure and violates best practices. If the code is compromised, the credentials can be exposed.
- B. Correct.
Assigning an IAM role to the Lambda function is the most secure way to manage access to AWS resources like DynamoDB. The role provides temporary credentials and adheres to the principle of least privilege.
- C. Incorrect.
Using hardcoded environment variables to store credentials is also insecure. If the environment variables are compromised, the credentials can be exposed.
- D. Incorrect.
Creating a user with programmatic access and passing the access keys to the Lambda function is not a secure practice. This can lead to credential leakage and is not recommended.