DVA-C02 Question 38
Single answerYou are developing a serverless application using AWS Lambda and need to ensure that the Lambda function has access to read and write to a DynamoDB table. How can you achieve this securely following AWS best practices?
- A
Attach an inline policy with the required permissions directly to the Lambda function.
- B
Create an IAM role with the required permissions and assign it to the Lambda function.
- C
Use an S3 bucket policy to grant access to the DynamoDB table.
- D
Embed the access keys of an IAM user with DynamoDB permissions directly within the Lambda function code.
Show answer and explanation
Correct answer: B
Explanation
To securely grant a Lambda function access to DynamoDB, you should create an IAM role with the necessary permissions and attach it to the Lambda function. This approach follows AWS's principle of least privilege and avoids the risks associated with hardcoding access keys or using inappropriate policies.
- A. Incorrect.
This is incorrect because attaching an inline policy directly to a Lambda function is not possible. Permissions must be granted via an execution role.
- B. Correct.
This is correct because the best practice for granting a Lambda function permissions is to create an IAM role with the necessary policies and assign it to the function. This avoids hardcoding credentials and ensures secure access.
- C. Incorrect.
This is incorrect because S3 bucket policies are used to manage access to S3 resources, not DynamoDB tables.
- D. Incorrect.
This is incorrect because embedding access keys in application code is not secure and violates AWS best practices. These keys could be exposed if the code is leaked.