DVA-C02 Question 39
Single answerYou are developing a serverless application using AWS Lambda and require your Lambda function to access an Amazon DynamoDB table. The function must have the necessary permissions, but you want to follow the principle of least privilege. How should you configure the permissions for the Lambda function?
- A
Attach the AmazonDynamoDBFullAccess managed policy to the Lambda function's execution role.
- B
Create a custom IAM policy granting only the specific actions needed on the DynamoDB table and attach it to the Lambda function's execution role.
- C
Assign the AWSLambdaBasicExecutionRole managed policy to the Lambda function's execution role.
- D
Manually embed the DynamoDB access credentials (access key and secret key) within your Lambda function code.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege dictates that permissions should be restricted to exactly what is required. By creating a custom IAM policy with the specific actions needed for your DynamoDB table and attaching it to the Lambda function's execution role, you ensure that the function has the minimum permissions required to operate securely. This approach avoids granting excessive permissions (such as FullAccess policies) and follows AWS security best practices.
- A. Incorrect.
Attaching the AmazonDynamoDBFullAccess managed policy provides full access to all DynamoDB tables, which violates the principle of least privilege.
- B. Correct.
Creating a custom IAM policy with only the required actions on the specific DynamoDB table adheres to the principle of least privilege and ensures secure access.
- C. Incorrect.
The AWSLambdaBasicExecutionRole managed policy only provides basic permissions for logging to Amazon CloudWatch Logs and does not grant access to DynamoDB.
- D. Incorrect.
Embedding access credentials directly in the Lambda function code is insecure and violates AWS best practices. Credentials should be managed through IAM roles.