DVA-C02 Question 71
Single answerYou are developing a serverless application that uses AWS Lambda and Amazon S3. The Lambda function processes image files uploaded to an S3 bucket and stores metadata in a DynamoDB table. The application must ensure that the Lambda function only has access to the specific S3 bucket and DynamoDB table it needs. How can this be achieved while following least privilege principles?
- A
Attach an AWSLambdaFullAccess policy to the Lambda function's execution role.
- B
Create a custom IAM policy granting access to the specific S3 bucket and DynamoDB table, and attach it to the Lambda function's execution role.
- C
Use AWS Organizations to restrict access to S3 and DynamoDB resources for the Lambda function.
- D
Grant public access to the S3 bucket and DynamoDB table so the Lambda function can access them without restrictions.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege is a key security concept in AWS. Lambda execution roles should have only the permissions necessary to perform their tasks. By creating a custom IAM policy that grants access to only the specific S3 bucket and DynamoDB table, you ensure security and adhere to least privilege principles. Using broader permissions or public access violates best practices.
- A. Incorrect.
Attaching AWSLambdaFullAccess provides broader permissions than required, violating the principle of least privilege.
- B. Correct.
Creating a custom IAM policy with specific permissions for the S3 bucket and DynamoDB table ensures the Lambda function has access only to the resources it needs, adhering to the principle of least privilege.
- C. Incorrect.
AWS Organizations is used to manage policies for accounts in an organization, not for configuring access to specific resources for Lambda functions.
- D. Incorrect.
Granting public access to the S3 bucket and DynamoDB table is a security risk and does not adhere to the principle of least privilege.