DVA-C02 Question 79
Single answerYou are developing a serverless application using AWS Lambda and Amazon DynamoDB. Your application needs to allow users to create, read, update, and delete (CRUD) items in a DynamoDB table called 'Users'. However, you want to ensure that only authenticated users can perform these actions. Which of the following is the recommended approach to implement this functionality?
- A
Use AWS Lambda to perform CRUD operations and attach an IAM role with permissions to the DynamoDB table.
- B
Allow unauthenticated users to call the DynamoDB APIs directly to perform CRUD operations.
- C
Use Amazon Cognito to manage user authentication and assign an authenticated role with DynamoDB permissions.
- D
Use an API Gateway to directly expose the DynamoDB table and secure it with an API key.
Show answer and explanation
Correct answer: C
Explanation
The best practice for implementing secure CRUD operations on a DynamoDB table is to use Amazon Cognito for user authentication. Cognito provides temporary, limited-privilege credentials for authenticated users, which can be used to access DynamoDB via an IAM role. This ensures that only authenticated users can perform CRUD actions while adhering to AWS security best practices.
- A. Incorrect.
This option ensures that CRUD operations are performed securely via Lambda, but it does not handle user authentication, which is a key requirement in the scenario.
- B. Incorrect.
Allowing unauthenticated users to access the DynamoDB APIs directly is insecure and violates best practices for securing application data.
- C. Correct.
This is the correct approach. Amazon Cognito manages user authentication and can assign temporary credentials to authenticated users, allowing them to access DynamoDB with the required permissions.
- D. Incorrect.
Exposing the DynamoDB table directly through an API Gateway and securing it only with an API key is not sufficient. API keys alone do not provide user-specific authentication.