SCS-C02 Question 375
Single answerYour organization uses an AWS Lambda function that requires access to an S3 bucket to retrieve input files and write processed output files. The team has reported that the Lambda function is failing to access the S3 bucket. Upon investigation, you find that the Lambda function has been assigned an IAM role. What step should you take to resolve the issue?
- A
Attach an inline policy to the IAM role associated with the Lambda function, granting the necessary S3 permissions.
- B
Directly attach an S3 bucket policy to the Lambda function.
- C
Attach a managed policy such as 'AmazonS3ReadOnlyAccess' to the IAM role associated with the Lambda function.
- D
Assign an IAM user with S3 permissions to the Lambda function.
Show answer and explanation
Correct answer: A
Explanation
To enable the Lambda function to interact with the S3 bucket, the IAM role assigned to the Lambda function must have the appropriate permissions. These permissions can be granted by attaching an inline policy to the IAM role, specifying the necessary S3 actions (e.g., 's3:GetObject' and 's3:PutObject'). Other options either misunderstand how IAM roles and policies work or do not fully satisfy the permission requirements in this scenario.
- A. Correct.
Correct. IAM roles assigned to the Lambda function need to include the necessary permissions. Attaching an inline policy to the IAM role with necessary S3 permissions is a valid solution.
- B. Incorrect.
Incorrect. S3 bucket policies cannot be attached directly to a Lambda function. They are used to control access to S3 resources based on conditions such as IAM roles or users.
- C. Incorrect.
Incorrect. While a managed policy like 'AmazonS3ReadOnlyAccess' might grant some permissions, it will not include write access to the S3 bucket, which is needed in this scenario.
- D. Incorrect.
Incorrect. Lambda functions cannot use IAM users; they rely on IAM roles for permissions.