SCS-C02 Question 395
Single answerYour organization uses AWS Lambda to process sensitive customer data. The Lambda functions require access to an Amazon S3 bucket to retrieve input files. You need to securely provide the Lambda functions with the necessary permissions while minimizing the risk of exposing sensitive credentials. Which of the following is the MOST secure way to achieve this?
- A
Embed an access key and secret key in the Lambda function's environment variables for the S3 bucket.
- B
Attach an AWS Identity and Access Management (IAM) role to the Lambda function with permissions scoped to the specific S3 bucket.
- C
Store the access key and secret key in AWS Secrets Manager and retrieve them from the Lambda function during execution.
- D
Use hardcoded credentials in the Lambda function's code to access the S3 bucket.
Show answer and explanation
Correct answer: B
Explanation
The best practice for securely providing credentials to AWS Lambda functions is to use IAM roles. By attaching an IAM role to the Lambda function, AWS automatically supplies temporary credentials to the function at runtime, scoped to the permissions defined in the role. This eliminates the need for static credentials, reducing the risk of exposure and ensuring secure access to resources like the S3 bucket.
- A. Incorrect.
Embedding an access key and secret key in environment variables is insecure because these credentials could be exposed if the environment variables are compromised. This method does not follow AWS best practices for securing credentials.
- B. Correct.
Attaching an IAM role to the Lambda function with permissions scoped to the specific S3 bucket is the most secure option. It avoids the use of static credentials and ensures that the permissions are dynamically assigned to the function at runtime.
- C. Incorrect.
While AWS Secrets Manager can securely store secrets, retrieving them in this context adds unnecessary complexity and introduces the risk of exposing credentials during the retrieval process. Using IAM roles is a more appropriate solution.
- D. Incorrect.
Hardcoding credentials in the function's code is a poor security practice. This exposes sensitive information and makes it difficult to rotate credentials if they are compromised.