DVA-C02 Question 37
Single answerYou are developing a serverless application using AWS Lambda. The Lambda function needs to interact with an Amazon S3 bucket to read and write data. The application must follow the principle of least privilege, and you need to ensure that the function has the necessary access to the S3 bucket. How can you achieve this?
- A
Create an IAM policy with S3 read and write permissions, attach it to the Lambda function's execution role, and specify the S3 bucket ARN in the policy's resource section.
- B
Grant public access to the S3 bucket so the Lambda function can read and write data without restriction.
- C
Use AWS Secrets Manager to store S3 credentials and retrieve them inside the Lambda function to authenticate directly with S3.
- D
Attach the AmazonS3FullAccess managed policy to the Lambda function's execution role.
Show answer and explanation
Correct answer: A
Explanation
The principle of least privilege is a critical security best practice that ensures entities only have the permissions they need to perform their tasks. By creating a custom IAM policy with S3 read and write permissions and attaching it to the Lambda function's execution role, you can limit access to only the specific S3 bucket the function needs to interact with. This approach avoids unnecessary permissions and enhances security. Other options either violate security principles or are not designed for this use case.
- A. Correct.
This is correct. Attaching an IAM policy with the necessary permissions to the Lambda function's execution role and specifying the S3 bucket ARN ensures that only the function has the access it needs, following the principle of least privilege.
- B. Incorrect.
This is incorrect. Granting public access to the S3 bucket is not secure and violates the principle of least privilege.
- C. Incorrect.
This is incorrect. Using AWS Secrets Manager to store S3 credentials is unnecessary because IAM roles can provide secure, temporary credentials for Lambda to access S3.
- D. Incorrect.
This is incorrect. While the AmazonS3FullAccess managed policy grants the required permissions, it provides broader access than necessary, violating the principle of least privilege.