DVA-C02 Question 383
Single answerA developer is building a serverless application that processes images uploaded to an Amazon S3 bucket. The application uses an AWS Lambda function for the processing, and the processed images are stored in another S3 bucket. The developer wants to ensure the Lambda function has the necessary permissions to read from the source bucket and write to the target bucket. What is the BEST way to achieve this?
- A
Attach an IAM policy to the Lambda function's execution role, granting S3 read and write permissions.
- B
Manually create an access key and secret key for the Lambda function, and embed them in the function's environment variables for S3 access.
- C
Configure the S3 bucket policies to allow public read and write access for the Lambda function.
- D
Attach an S3-specific managed policy directly to the Lambda function's execution role.
Show answer and explanation
Correct answer: A
Explanation
To securely grant an AWS Lambda function permissions to access other AWS resources, you should attach an IAM policy to the function's execution role. This is the best practice for managing permissions in a serverless application. Embedding access keys in the function or making the S3 bucket public are insecure approaches that should be avoided.
- A. Correct.
Correct. Granting permissions to the Lambda function through its execution role is the recommended and secure approach for accessing AWS resources.
- B. Incorrect.
Incorrect. Embedding access keys in environment variables is not a secure practice and goes against AWS best practices for security.
- C. Incorrect.
Incorrect. Making S3 buckets publicly accessible is not secure and violates AWS security best practices.
- D. Incorrect.
Incorrect. While managed policies can be used, attaching specific permissions through a custom IAM policy is a more flexible and secure approach.