DEA-C01 Data Security and Governance Practice Question

A data engineer must give an AWS Lambda function temporary credentials to read objects from a specific Amazon S3 prefix. The function runs in a VPC and accesses S3 through a gateway VPC endpoint. The security team forbids long-lived access keys on the function. What should the data engineer configure?

⚠ Common exam trap

The trap here is assuming that storing credentials in Secrets Manager or environment variables removes the risk of long-lived keys, when only role-based temporary credentials satisfy the requirement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Attach an IAM role to the Lambda function with an S3 read policy scoped to the prefix, and add an S3 bucket policy restricting access to the gateway VPC endpoint.

Lambda execution roles supply temporary credentials automatically, eliminating static keys while allowing a policy scoped to the required prefix. Combining that with a bucket policy that permits access only through the gateway VPC endpoint keeps the data path private and prevents access from outside the approved network route.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Store an IAM user's access key ID and secret access key in Lambda environment variables and rotate them monthly.
Why it's wrong here
Environment variables are readable by anyone who can view the function configuration, and long-lived access keys violate the stated prohibition. Monthly rotation reduces but does not eliminate exposure, and the requirement explicitly forbids long-lived credentials on the function.
✓
Attach an IAM role to the Lambda function with an S3 read policy scoped to the prefix, and add an S3 bucket policy restricting access to the gateway VPC endpoint.
Why this is correct
Lambda assumes an execution role and receives temporary credentials through the environment, so no static keys are stored. Scoping the policy to the prefix and adding a bucket policy that allows access only through the specified VPC endpoint enforces least privilege and ensures traffic stays on the private path.
✗
Use the Lambda function's reserved concurrency setting to limit access, and allow S3 access through the VPC endpoint policy only.
Why it's wrong here
Reserved concurrency governs how many concurrent invocations the function can run; it has no bearing on identity or authorization. Relying on the VPC endpoint policy alone provides no identity for the function, so S3 cannot determine which principal is calling and the read would be denied.
✗
Create an IAM user and store the credentials in AWS Secrets Manager, then call the secret at runtime from Lambda.
Why it's wrong here
Fetching long-lived IAM user credentials from Secrets Manager still uses static keys that do not expire per invocation and can be replayed if leaked. It adds a secret-retrieval dependency without satisfying the requirement for temporary credentials derived from a role.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question