DVA-C02 Question 72
Single answerYou are developing a serverless application using AWS Lambda and need to securely provide your function with access to an Amazon S3 bucket. Which of the following is the most appropriate way to achieve this?
- A
Hardcode the S3 bucket credentials within the Lambda function code.
- B
Create an IAM role with appropriate permissions for the S3 bucket and assign it to the Lambda function.
- C
Pass the S3 bucket credentials as environment variables to the Lambda function.
- D
Use AWS Secrets Manager to store the S3 access key and retrieve it within the Lambda function.
Show answer and explanation
Correct answer: B
Explanation
The best practice for securely providing AWS Lambda functions with access to other AWS services, such as S3, is to use IAM roles. IAM roles allow you to define fine-grained permissions and automatically manage credentials on your behalf, eliminating the need to hardcode or manually manage sensitive information. Other methods, such as hardcoding credentials or using environment variables, introduce security risks and operational challenges.
- A. Incorrect.
Hardcoding credentials within the Lambda function code is a bad practice as it exposes sensitive information and makes key rotation difficult.
- B. Correct.
Using an IAM role with appropriate permissions and assigning it to the Lambda function is the best practice. It ensures secure and automated access to the S3 bucket without exposing credentials.
- C. Incorrect.
Using environment variables for credentials is not secure as it still exposes sensitive information in your application configuration.
- D. Incorrect.
While AWS Secrets Manager is a secure way to store secrets, storing S3 access keys here is not recommended when IAM roles can directly provide secure access without requiring keys.