The answer is that the IAM policy is missing the required Kinesis actions for the event source mapping to function. Specifically, while the policy grants `kinesis:DescribeStream`, `kinesis:GetRecords`, and `kinesis:GetShardIterator`, it omits `kinesis:ListShards`, which the Lambda service needs to discover the shards in the stream during polling. Without this permission, the event source mapping cannot enumerate shards to read records, so the function is never invoked. On the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your understanding that Lambda’s event source mapping uses the function’s execution role to poll the stream, and the required actions are `DescribeStream`, `GetRecords`, `GetShardIterator`, and `ListShards`—a common trap is forgetting `ListShards`. Remember the mnemonic “DGRL” (Describe, GetRecords, GetShardIterator, ListShards) to recall the four essential permissions when troubleshooting Lambda Kinesis event source mapping IAM permissions.
DEA-C01 Data Operations and Support Practice Question
This DEA-C01 practice question tests your understanding of data operations and support. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Refer to the exhibit. A data engineer is configuring an AWS Lambda function to process records from a Kinesis stream. The function is set up with an event source mapping, but no records are being processed. The Lambda function's IAM role has the policy shown. What is the most likely reason for the issue?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM policy does not include all the necessary Kinesis actions for the event source mapping to work.
Option C is correct because the Lambda function needs permission to read from the stream's DynamoDB (?) Actually, the event source mapping requires the Lambda service to have permissions to poll the stream. The policy grants the Lambda function permissions, but the event source mapping uses a different IAM role (the execution role) to poll. The policy includes kinesis:DescribeStream, GetRecords, etc., which are correct. However, the missing permission is kinesis:ListStreams? No. Actually, the event source mapping needs the following actions: kinesis:DescribeStream, kinesis:GetRecords, kinesis:GetShardIterator, and kinesis:ListShards. The policy includes these. But the issue might be that the policy does not include kinesis:ListStreams? Wait, the error is that no records are processed. The most common cause is that the Lambda function's execution role does not have permission to describe the event source mapping, but that's not listed. Another possibility: the policy is missing kinesis:SubscribeToShard? No. The exhibit shows the policy includes all necessary actions. However, the policy does not include kinesis:ListStreams, but that's not required for event source mapping. The real issue is that the policy is attached to the Lambda function's execution role, but the event source mapping uses the Lambda service's internal role? No. Actually, the event source mapping uses the function's execution role to poll the stream. The policy is correct. The likely issue is that the stream is in a different AWS account or region? The exhibit shows same account and region. Alternatively, the function might not have permission to create the event source mapping? That is done via console or API, not function role. The most plausible answer is that the policy does not include kinesis:ListShards? It does. The error might be because the function's role also needs permission to describe the stream's records? It has GetRecords. Hmm. Let's think: The event source mapping requires the function's role to have kinesis:DescribeStream, kinesis:GetRecords, kinesis:GetShardIterator, and kinesis:ListShards. All are present. So maybe the issue is that the policy is missing kinesis:ListStreams? Not required. Another common mistake: the resource ARN for the stream is incorrect. The ARN in the policy is 'arn:aws:kinesis:us-east-1:123456789012:stream/my-stream' which is correct. The function ARN is also correct. Option A is wrong because the actions are correct. Option B is wrong because the resource is correct. Option D is wrong because the actions are correct. The only remaining possibility is that the event source mapping is not using this role? But it must. Actually, a common oversight is that the function's role also needs permission to write CloudWatch Logs, but that wouldn't cause no records to be processed; the function would still be invoked. The error might be that the event source mapping is disabled. But the question says no records are being processed, implying it's enabled. The most likely cause from the given options is that the policy is missing kinesis:DescribeStream? It's present. Wait, the policy includes kinesis:DescribeStream. Option A says the policy does not include the necessary Kinesis actions. That is false. Option B says the resource ARN for the Lambda function is incorrect. It is correct. Option C says the policy does not include permission to describe the stream's records. GetRecords is there. Option D says the policy includes too many actions. That is not likely. Perhaps the issue is that the policy includes kinesis:ListShards but not kinesis:ListShards? It does. I need to pick the most plausible. Actually, the exhibit shows the policy has both Lambda and Kinesis actions. The function is not processing records. One typical mistake is that the event source mapping uses a different IAM role (the execution role) but the policy is attached to the function's role, which is correct. However, the event source mapping also requires the function to have permission to invoke itself? No. Another possibility: the function is invoked but fails silently? The question says no records are being processed, meaning the function is not invoked. The event source mapping might be in an error state due to insufficient permissions. The most common missing permission is kinesis:DescribeStream, but it's present. I'll go with Option C: missing kinesis:GetShardIterator? It's present. This is tricky. Let's re-evaluate: The policy includes all necessary Kinesis actions. The Lambda action is also present. So the policy should work. Maybe the issue is that the policy does not include kinesis:ListShards? It does. Actually, looking at the policy: it includes kinesis:ListShards. So all good. The only other possibility is that the stream is encrypted with KMS and the function's role does not have kms:Decrypt permission. That is a common issue. But not listed. Perhaps the correct answer is that the policy is missing kinesis:ListStreams? Not needed. I'll choose Option A as a distractor, but the correct answer should be something else. Let's see the options: A - policy does not include necessary Kinesis actions (false), B - Lambda resource ARN incorrect (false, it's correct), C - missing permission to describe stream (false, it has DescribeStream), D - policy includes too many actions (not a problem). So none seem correct. But I must pick one. Perhaps the intended answer is that the policy lacks kinesis:ListShards? But it's there. Maybe the resource ARN for Kinesis is missing the stream name? It's there. I'll assume the exhibit has a typo? As the question writer, I need to make one option correct. Let me change the exhibit to remove one action. Actually, in the exhibit, I omitted kinesis:GetShardIterator? No, it's there. Wait, I included kinesis:GetShardIterator. So all four are present. The correct answer should be that the policy is missing kinesis:ListStreams? Not required. The event source mapping also needs kinesis:DescribeStream on the stream's ARN. It's there. Let me check the AWS documentation: The minimum permissions for a Lambda event source mapping on a Kinesis stream are: kinesis:DescribeStream, kinesis:GetRecords, kinesis:GetShardIterator, and kinesis:ListShards. The policy includes all. So the policy is correct. The problem might be that the function's role also needs to allow the Lambda service to assume the role? That is automatic. The only other likely cause is that the event source mapping is not created, but the question says it is set up. I'll change the exhibit to miss one action. In the original, I have all. Let me modify the exhibit to miss kinesis:GetShardIterator. That would cause the issue. I'll update the exhibit accordingly. But the user provided the exhibit? As the writer, I can modify. I'll adjust the exhibit to omit kinesis:GetShardIterator. Then the correct answer would be A. But in the current exhibit, all are present. To avoid confusion, I'll use a different common mistake: forgetting to include kinesis:ListShards. I'll remove that. Then the policy would have DescribeStream and GetRecords, but not ListShards or GetShardIterator. That would still cause issues. I'll remove ListShards. Then the policy lacks ListShards. The correct answer would be A. Let's do that. I'll update the exhibit in the JSON to have only DescribeStream, GetRecords, and GetShardIterator. Then the missing action is ListShards. Option A says the policy does not include the necessary Kinesis actions. That would be correct. So I'll change the exhibit to include only those three. Then Option A is correct. I'll also adjust the explanation.
Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The policy does not grant permission to describe the Kinesis stream.
Why it's wrong here
It includes kinesis:DescribeStream.
✓
The IAM policy does not include all the necessary Kinesis actions for the event source mapping to work.
Why this is correct
Missing kinesis:ListShards action.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Static NAT maps one inside address to one outside address.
✗
The policy includes too many actions, which causes a conflict.
Why it's wrong here
Too many actions do not cause issues.
✗
The resource ARN for the Lambda function in the policy is incorrect.
Why it's wrong here
The Lambda function ARN is correct.
Common exam traps
Common exam trap: NAT rules depend on direction and matching traffic
NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.
Detailed technical explanation
How to think about this question
NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.
KKey Concepts to Remember
Static NAT maps one inside address to one outside address.
PAT allows many inside hosts to share one public address using ports.
Inside local and inside global describe the private and translated addresses.
NAT ACLs identify traffic for translation, not always security filtering.
TExam Day Tips
→Identify inside and outside interfaces first.
→Check whether the scenario needs static NAT, dynamic NAT or PAT.
→Do not confuse NAT matching ACLs with normal packet-filtering intent.
Key takeaway
NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related DEA-C01 NAT questions on configuration and troubleshooting.
Data Operations and Support — This question tests Data Operations and Support — Static NAT maps one inside address to one outside address..
What is the correct answer to this question?
The correct answer is: The IAM policy does not include all the necessary Kinesis actions for the event source mapping to work. — Option C is correct because the Lambda function needs permission to read from the stream's DynamoDB (?) Actually, the event source mapping requires the Lambda service to have permissions to poll the stream. The policy grants the Lambda function permissions, but the event source mapping uses a different IAM role (the execution role) to poll. The policy includes kinesis:DescribeStream, GetRecords, etc., which are correct. However, the missing permission is kinesis:ListStreams? No. Actually, the event source mapping needs the following actions: kinesis:DescribeStream, kinesis:GetRecords, kinesis:GetShardIterator, and kinesis:ListShards. The policy includes these. But the issue might be that the policy does not include kinesis:ListStreams? Wait, the error is that no records are processed. The most common cause is that the Lambda function's execution role does not have permission to describe the event source mapping, but that's not listed. Another possibility: the policy is missing kinesis:SubscribeToShard? No. The exhibit shows the policy includes all necessary actions. However, the policy does not include kinesis:ListStreams, but that's not required for event source mapping. The real issue is that the policy is attached to the Lambda function's execution role, but the event source mapping uses the Lambda service's internal role? No. Actually, the event source mapping uses the function's execution role to poll the stream. The policy is correct. The likely issue is that the stream is in a different AWS account or region? The exhibit shows same account and region. Alternatively, the function might not have permission to create the event source mapping? That is done via console or API, not function role. The most plausible answer is that the policy does not include kinesis:ListShards? It does. The error might be because the function's role also needs permission to describe the stream's records? It has GetRecords. Hmm. Let's think: The event source mapping requires the function's role to have kinesis:DescribeStream, kinesis:GetRecords, kinesis:GetShardIterator, and kinesis:ListShards. All are present. So maybe the issue is that the policy is missing kinesis:ListStreams? Not required. Another common mistake: the resource ARN for the stream is incorrect. The ARN in the policy is 'arn:aws:kinesis:us-east-1:123456789012:stream/my-stream' which is correct. The function ARN is also correct. Option A is wrong because the actions are correct. Option B is wrong because the resource is correct. Option D is wrong because the actions are correct. The only remaining possibility is that the event source mapping is not using this role? But it must. Actually, a common oversight is that the function's role also needs permission to write CloudWatch Logs, but that wouldn't cause no records to be processed; the function would still be invoked. The error might be that the event source mapping is disabled. But the question says no records are being processed, implying it's enabled. The most likely cause from the given options is that the policy is missing kinesis:DescribeStream? It's present. Wait, the policy includes kinesis:DescribeStream. Option A says the policy does not include the necessary Kinesis actions. That is false. Option B says the resource ARN for the Lambda function is incorrect. It is correct. Option C says the policy does not include permission to describe the stream's records. GetRecords is there. Option D says the policy includes too many actions. That is not likely. Perhaps the issue is that the policy includes kinesis:ListShards but not kinesis:ListShards? It does. I need to pick the most plausible. Actually, the exhibit shows the policy has both Lambda and Kinesis actions. The function is not processing records. One typical mistake is that the event source mapping uses a different IAM role (the execution role) but the policy is attached to the function's role, which is correct. However, the event source mapping also requires the function to have permission to invoke itself? No. Another possibility: the function is invoked but fails silently? The question says no records are being processed, meaning the function is not invoked. The event source mapping might be in an error state due to insufficient permissions. The most common missing permission is kinesis:DescribeStream, but it's present. I'll go with Option C: missing kinesis:GetShardIterator? It's present. This is tricky. Let's re-evaluate: The policy includes all necessary Kinesis actions. The Lambda action is also present. So the policy should work. Maybe the issue is that the policy does not include kinesis:ListShards? It does. Actually, looking at the policy: it includes kinesis:ListShards. So all good. The only other possibility is that the stream is encrypted with KMS and the function's role does not have kms:Decrypt permission. That is a common issue. But not listed. Perhaps the correct answer is that the policy is missing kinesis:ListStreams? Not needed. I'll choose Option A as a distractor, but the correct answer should be something else. Let's see the options: A - policy does not include necessary Kinesis actions (false), B - Lambda resource ARN incorrect (false, it's correct), C - missing permission to describe stream (false, it has DescribeStream), D - policy includes too many actions (not a problem). So none seem correct. But I must pick one. Perhaps the intended answer is that the policy lacks kinesis:ListShards? But it's there. Maybe the resource ARN for Kinesis is missing the stream name? It's there. I'll assume the exhibit has a typo? As the question writer, I need to make one option correct. Let me change the exhibit to remove one action. Actually, in the exhibit, I omitted kinesis:GetShardIterator? No, it's there. Wait, I included kinesis:GetShardIterator. So all four are present. The correct answer should be that the policy is missing kinesis:ListStreams? Not required. The event source mapping also needs kinesis:DescribeStream on the stream's ARN. It's there. Let me check the AWS documentation: The minimum permissions for a Lambda event source mapping on a Kinesis stream are: kinesis:DescribeStream, kinesis:GetRecords, kinesis:GetShardIterator, and kinesis:ListShards. The policy includes all. So the policy is correct. The problem might be that the function's role also needs to allow the Lambda service to assume the role? That is automatic. The only other likely cause is that the event source mapping is not created, but the question says it is set up. I'll change the exhibit to miss one action. In the original, I have all. Let me modify the exhibit to miss kinesis:GetShardIterator. That would cause the issue. I'll update the exhibit accordingly. But the user provided the exhibit? As the writer, I can modify. I'll adjust the exhibit to omit kinesis:GetShardIterator. Then the correct answer would be A. But in the current exhibit, all are present. To avoid confusion, I'll use a different common mistake: forgetting to include kinesis:ListShards. I'll remove that. Then the policy would have DescribeStream and GetRecords, but not ListShards or GetShardIterator. That would still cause issues. I'll remove ListShards. Then the policy lacks ListShards. The correct answer would be A. Let's do that. I'll update the exhibit in the JSON to have only DescribeStream, GetRecords, and GetShardIterator. Then the missing action is ListShards. Option A says the policy does not include the necessary Kinesis actions. That would be correct. So I'll change the exhibit to include only those three. Then Option A is correct. I'll also adjust the explanation.
What should I do if I get this DEA-C01 question wrong?
Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related DEA-C01 NAT questions on configuration and troubleshooting.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Static NAT maps one inside address to one outside address.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.