DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Grant access to all DynamoDB tables using a wildcard in the resource ARN.

  Why it's wrong here

  Granting access to all DynamoDB tables using a wildcard (e.g., `arn:aws:dynamodb:*:*:table/*`) in the resource ARN is a severe security misconfiguration. This approach directly violates the principle of least privilege by providing a Lambda function access to every table in the account, even those it doesn't need. Such broad permissions significantly increase the attack surface and potential impact if the Lambda function or its execution role is compromised, making it an unacceptable practice.

• ✗

  Use a single IAM role shared by all Lambda functions.

  Why it's wrong here

  Using a single IAM role shared by all Lambda functions in a microservices architecture directly violates the principle of least privilege. Each microservice typically has distinct resource access requirements, and a shared role would necessitate granting the union of all permissions to every function. This over-privileging means a function could potentially access resources it should not, creating unnecessary security risks and making auditing difficult and less effective.

• ✗

  Attach the IAM policy to the AWS account instead of the role.

  Why it's wrong here

  Attaching an IAM policy directly to the AWS account is not a recommended security practice for managing permissions for specific services or applications. Account-level policies, such as Service Control Policies (SCPs) in AWS Organizations, are typically used for guardrails across Organizational Units, not for granting specific runtime permissions to individual resources like Lambda functions. For fine-grained control and adherence to least privilege, policies should always be attached to IAM roles or users, which are then assumed by services or individuals.

• ✓

  Scope the IAM policy resource to the specific DynamoDB table ARN.

  Why this is correct

  Scoping the IAM policy resource to the specific DynamoDB table ARN (e.g., `arn:aws:dynamodb:region:account-id:table/TableName`) is a fundamental best practice for enforcing the principle of least privilege. This ensures that the Lambda function's execution role only has permissions to interact with the exact DynamoDB table it requires for its operations. This precise resource definition minimizes the potential blast radius of a security incident, as unauthorized access would be confined to only the explicitly allowed resource.

• ✓

  Create a separate IAM role for each Lambda function.

  Why this is correct

  Creating a separate IAM role for each Lambda function is a cornerstone of a secure microservices architecture, directly enforcing the principle of least privilege at a granular level. Each function can then be assigned a role with only the precise permissions it needs to perform its specific task, such as reading from one S3 bucket and writing to a particular DynamoDB table. This isolation prevents a compromised function from gaining unauthorized access to resources intended for other services.

Go deeper

Related to this question