SAA-C03 Question 56
Single answerA company is developing a serverless web application that needs to securely access an Amazon DynamoDB table. The application is hosted on AWS Lambda. How can you ensure secure access to the DynamoDB table with the least operational overhead?
- A
Embed the DynamoDB access credentials directly in the Lambda function's code.
- B
Store the DynamoDB access credentials in AWS Secrets Manager and retrieve them at runtime.
- C
Assign an IAM role to the Lambda function with permissions to access the DynamoDB table.
- D
Use an API Gateway to proxy requests between the Lambda function and the DynamoDB table.
Show answer and explanation
Correct answer: C
Explanation
The most secure and operationally efficient way to grant a Lambda function access to a DynamoDB table is by assigning an IAM role to the Lambda function. This eliminates the need to manage credentials manually and adheres to AWS best practices for secure application access. By leveraging IAM roles, you can define fine-grained permissions and ensure that the Lambda function only has the access it needs.
- A. Incorrect.
Embedding credentials in the Lambda function's code is highly insecure and violates best practices for credential management. This creates a security risk if the code is exposed.
- B. Incorrect.
While storing credentials in AWS Secrets Manager is a secure approach, it introduces additional operational overhead and is unnecessary when Lambda can use an IAM role directly.
- C. Correct.
Assigning an IAM role to the Lambda function is the best practice. This approach ensures secure access to DynamoDB without managing credentials manually and leverages AWS Identity and Access Management (IAM) for granular permissions.
- D. Incorrect.
Using API Gateway as a proxy does not address the security of the Lambda function's access to DynamoDB. It is not a secure or necessary solution for this specific scenario.