SAA-C03 Question 42
Single answerA development team is building a serverless application using AWS Lambda functions. The application requires access to an Amazon DynamoDB table to store and retrieve data. To ensure secure access while adhering to the principle of least privilege, how should the team configure the application?
- A
Embed the access keys of an IAM user with DynamoDB permissions directly into the application code.
- B
Assign an IAM role to the Lambda function with the necessary permissions to access the DynamoDB table.
- C
Store the access keys of an IAM user with DynamoDB permissions in AWS Secrets Manager and retrieve them from the Lambda function at runtime.
- D
Assign the Lambda function a policy granting full access to all DynamoDB tables in the AWS account.
Show answer and explanation
Correct answer: B
Explanation
The best practice for securing application credentials and adhering to the principle of least privilege is to use IAM roles. By assigning an IAM role to the Lambda function, AWS automatically provides secure, temporary credentials scoped to the permissions defined in the role. This eliminates the need for hardcoding or managing long-term access keys, reducing the risk of accidental exposure.
- A. Incorrect.
Embedding access keys directly into application code is a security anti-pattern. If the code is exposed (e.g., through a public Git repository), the credentials could be compromised.
- B. Correct.
Assigning an IAM role to the Lambda function is the recommended approach. The role provides temporary security credentials, ensuring secure and auditable access to the DynamoDB table without hardcoding credentials.
- C. Incorrect.
While AWS Secrets Manager is a secure way to store sensitive data, retrieving access keys at runtime adds unnecessary complexity when IAM roles can provide secure, temporary credentials natively.
- D. Incorrect.
Granting full access to all DynamoDB tables violates the principle of least privilege and exposes the application to unintended risks. Permissions should be scoped to the specific resources required.