SAA-C03 Question 41
Single answerYour company is developing a serverless application using AWS Lambda. The application needs to securely access an Amazon S3 bucket to store and retrieve files. What is the MOST secure way to grant the Lambda function access to the S3 bucket?
- A
Embed the S3 bucket credentials directly into the Lambda function code.
- B
Store the S3 bucket access keys in an encrypted file within an Amazon S3 bucket and import them into the Lambda function at runtime.
- C
Assign an IAM role to the Lambda function with permissions to access the S3 bucket.
- D
Use environment variables in the Lambda function to store the S3 bucket access keys.
Show answer and explanation
Correct answer: C
Explanation
When granting AWS Lambda functions access to other AWS resources, the recommended approach is to assign an IAM role to the Lambda function. This allows AWS to automatically provide secure, temporary credentials to the function when it executes, removing the need to manage or expose static credentials. This approach adheres to the principle of least privilege and helps maintain a secure application architecture.
- A. Incorrect.
Embedding credentials directly into the Lambda function code is highly insecure because it exposes the credentials to anyone with access to the code, violating AWS security best practices.
- B. Incorrect.
Storing access keys in an encrypted file in S3 and importing them at runtime is not ideal as it relies on access keys and adds unnecessary complexity. Additionally, managing such keys securely can be error-prone.
- C. Correct.
Assigning an IAM role to the Lambda function is the MOST secure method according to AWS best practices. IAM roles provide temporary security credentials, eliminating the need to handle long-term keys.
- D. Incorrect.
Using environment variables to store access keys is insecure because the keys could be exposed, especially if the environment variables are not encrypted or properly controlled.