DVA-C02 Question 325
Single answerYou are developing a serverless application using AWS Lambda, and your function needs access to an Amazon S3 bucket to read and write objects. What is the best way to grant this access while following the principle of least privilege?
- A
Attach an inline policy to the Lambda function's execution role, granting permissions to access the specific S3 bucket.
- B
Embed the AWS access key and secret key for an IAM user with S3 access directly in the Lambda function's environment variables.
- C
Create a new IAM user with S3 access and use its credentials inside the Lambda function.
- D
Attach a managed policy with full S3 access permissions to the Lambda function's execution role.
Show answer and explanation
Correct answer: A
Explanation
The principle of least privilege requires that resources receive only the permissions they need to perform their tasks. By attaching an inline policy to the Lambda function's execution role, you can restrict the permissions to the specific S3 bucket the function needs to access. This approach is secure and aligns with AWS best practices. Storing credentials in environment variables or using a managed policy with overly broad permissions would increase security risks and violate the principle of least privilege.
- A. Correct.
This is correct. Attaching an inline policy to the Lambda function's execution role ensures that the function has the required permissions, and the permissions are limited to the specific S3 bucket, adhering to the principle of least privilege.
- B. Incorrect.
This is incorrect. Storing access keys in environment variables is not secure and goes against AWS best practices.
- C. Incorrect.
This is incorrect. Creating a new IAM user and using its credentials inside the Lambda function is both insecure and unnecessary when Lambda execution roles are the proper mechanism to grant permissions.
- D. Incorrect.
This is incorrect. Granting full S3 access via a managed policy violates the principle of least privilege and unnecessarily exposes all S3 buckets to the Lambda function.