SY0-701 Question 158
Single answerServerlessA company has migrated part of its customer support application to a serverless architecture. An API gateway invokes a cloud function that reads and writes customer case data in a managed database. During a security review, the team discovers the function's execution role has broad permissions to multiple storage buckets and databases that are unrelated to the application. The team wants to reduce the risk of unauthorized access if the function is abused, while keeping the application working normally. Which of the following is the BEST action to take?
- A
Replace the serverless function with a long-running virtual machine so the team can install host-based security agents
- B
Apply a least-privilege IAM policy to the function's execution role so it can access only the specific database tables and storage resources required
- C
Store database credentials in the function's environment variables so the function does not need an execution role
- D
Move the function into a private subnet to prevent it from accessing unrelated cloud resources
Show answer and explanation
Correct answer: B
Explanation
The key security issue in this scenario is excessive privilege in the serverless function's execution role. In serverless environments, cloud IAM is one of the most important security boundaries because there is no traditional host for administrators to harden in the same way as a server or VM. Applying least privilege to the function's role reduces the impact of code vulnerabilities, injection flaws, or abuse of the function. This aligns with Security+ principles such as least privilege and limiting blast radius. Major cloud providers document this as a best practice for serverless workloads: use narrowly scoped roles or identities, grant only required actions on specific resources, and avoid broad wildcard permissions. Network placement and secret management are still important, but they are secondary to fixing the excessive authorization problem described.
- A. Incorrect.
Incorrect. Moving from serverless to virtual machines does not directly solve the identified issue, which is excessive permissions granted to the workload identity. Host-based agents may improve visibility on a VM, but they do not enforce proper authorization to cloud resources by themselves. This option reflects a common misconception that changing compute models is the primary fix for an IAM problem.
- B. Correct.
Correct. In a serverless model, the function's execution role should follow the principle of least privilege. Restricting the IAM policy to only the exact database tables, storage buckets, and actions the function requires limits blast radius if the function is exploited or misused. This is the most effective control for the scenario because the risk identified is unauthorized access caused by overly broad permissions.
- C. Incorrect.
Incorrect. Placing credentials in environment variables is generally less secure than using the cloud provider's managed identity or execution role. It can increase the risk of credential exposure through logs, configuration disclosure, or overly broad secret reuse. The issue is not that the function lacks credentials, but that its existing identity has excessive privileges.
- D. Incorrect.
Incorrect. Network isolation can help reduce exposure to certain services, but it does not replace authorization controls. A private subnet does not inherently stop a function from using its cloud identity to access resources the IAM policy permits. This option is plausible because subnet placement is a common security control, but it does not directly address excessive permissions.