DVA-C02 Question 3
Single answerYou are developing a serverless web application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application requires secure, temporary access to write data to the DynamoDB table from the Lambda function. How should you configure this access?
- A
Attach an inline policy with write permissions to the Lambda function's execution role.
- B
Hardcode AWS credentials as environment variables in the Lambda function.
- C
Create an IAM user with write permissions to DynamoDB and use its access keys in the Lambda function.
- D
Grant write permissions to the DynamoDB table for all users in the account.
Show answer and explanation
Correct answer: A
Explanation
The best practice for granting access to AWS services, such as DynamoDB, from a Lambda function is to use the Lambda function's execution role. You can attach an inline policy to the execution role with the necessary permissions, such as the write permissions required in this scenario. This approach ensures that temporary credentials are securely and automatically provided to the Lambda function, adhering to the principle of least privilege.
- A. Correct.
Correct. Attaching an inline policy with write permissions to the Lambda function's execution role ensures secure, temporary access to the DynamoDB table. This is the recommended practice for assigning permissions in AWS serverless architectures.
- B. Incorrect.
Incorrect. Hardcoding AWS credentials in the Lambda function's environment variables is a security risk and violates best practices. AWS credentials should never be hardcoded.
- C. Incorrect.
Incorrect. Creating an IAM user and using its access keys in the Lambda function is not a secure or scalable solution, and it doesn't leverage temporary credentials provided by the execution role.
- D. Incorrect.
Incorrect. Granting write permissions to all users in the account creates a security vulnerability by over-provisioning access to the DynamoDB table.