DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure a resource-based policy on the Lambda function to allow DynamoDB access.

  Why it's wrong here

  Configuring a resource-based policy on the Lambda function is incorrect because these policies define who can invoke the Lambda function or access its own resources, not what external AWS services the Lambda function itself can access. To grant a Lambda function permissions to interact with other services like DynamoDB, an identity-based policy must be attached to the function's IAM execution role, which dictates the permissions the function assumes during execution.

• ✗

  Attach the AmazonDynamoDBFullAccess managed policy to the Lambda execution role.

  Why it's wrong here

  Attaching the AmazonDynamoDBFullAccess managed policy to the Lambda execution role is a poor security practice as it grants permissions to perform all DynamoDB actions on all DynamoDB tables within the entire AWS account. While this would technically allow access, it severely violates the principle of least privilege, which mandates granting only the minimum necessary permissions required for the function's specific task, increasing the risk surface.

• ✗

  Use an S3 bucket policy to grant the Lambda function access to the DynamoDB table.

  Why it's wrong here

  Using an S3 bucket policy to grant the Lambda function access to a DynamoDB table is fundamentally incorrect because S3 bucket policies are exclusively designed to control access to objects and operations within a specific Amazon S3 bucket. These policies are service-specific and possess no authority or mechanism to grant permissions for accessing resources in a completely different AWS service like Amazon DynamoDB. Permissions for DynamoDB must be managed through IAM policies relevant to DynamoDB.

• ✓

  Create a custom IAM policy with specific DynamoDB actions (e.g., GetItem, PutItem) on the specific table and attach it to the Lambda execution role.

  Why this is correct

  Creating a custom IAM policy with specific DynamoDB actions (e.g., GetItem, PutItem) on the specific table and attaching it to the Lambda execution role is the correct and most secure approach. This method strictly adheres to the principle of least privilege by granting only the precise actions required (e.g., `dynamodb:GetItem`, `dynamodb:PutItem`) on the exact DynamoDB table resource (specified by its ARN), minimizing potential security risks and ensuring the function has only necessary permissions.