DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless application using AWS Lambda to process images uploaded to an S3 bucket. The Lambda function needs to resize each image and store the result in another S3 bucket. Which TWO actions should the developer take to ensure the function can access the S3 buckets securely?
⚠ Common exam trap
Many candidates think they need to embed static credentials (access keys) in the function code or environment variables, but the AWS Well-Architected Framework mandates using IAM roles for temporary, least-privilege credentials in serverless applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM execution role for the Lambda function with permissions to read from the source bucket and write to the destination bucket.
Lambda functions require an IAM execution role that grants permissions to access other AWS services. By creating a role with policies that allow s3:GetObject on the source bucket and s3:PutObject on the destination bucket, the function can securely read and write images without embedding long-term credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM execution role for the Lambda function with permissions to read from the source bucket and write to the destination bucket.
Why this is correct
Creating an IAM execution role is the standard and most secure method for a Lambda function to interact with other AWS services. This role defines the permissions the function assumes when invoked, allowing it to read objects from the source S3 bucket and write processed objects to the destination S3 bucket without embedding any static credentials. This adheres to the principle of least privilege, granting only necessary access.
- ✓
Configure a bucket policy on the destination S3 bucket that grants the Lambda execution role s3:PutObject permission.
Why this is correct
Configuring a bucket policy on the destination S3 bucket that explicitly grants s3:PutObject permission to the Lambda function's execution role is often a necessary security measure, especially when the buckets might be in different accounts or to enforce specific access controls at the resource level. While the Lambda execution role defines what the function can do, the bucket policy defines who can access the bucket, acting as a second layer of authorization. Both are frequently required for robust cross-service or cross-account interactions.
- ✗
Store the AWS access key and secret key in the Lambda environment variables.
Why it's wrong here
Storing AWS access keys and secret keys directly in Lambda environment variables is an insecure practice that violates the principle of least privilege and increases the risk of credential compromise. Lambda functions are designed to assume an IAM execution role, which provides temporary, rotating credentials automatically, eliminating the need to manage static long-term credentials within the application code or configuration.
- ✗
Assign an IAM user to the Lambda function and embed the user's access key in the function code.
Why it's wrong here
Lambda functions do not operate under the context of an IAM user; they assume an IAM execution role to gain permissions. Assigning an IAM user and embedding its access key in the function code is fundamentally incorrect for Lambda's security model and highly insecure. This approach introduces static, long-lived credentials directly into the application, making them vulnerable to exposure and difficult to rotate.
- ✗
Attach an IAM instance profile to the Lambda function.
Why it's wrong here
An IAM instance profile is a container for an IAM role that is specifically designed to be attached to an Amazon EC2 instance, allowing applications running on that instance to assume the associated role. Lambda functions operate in a serverless environment and do not utilize EC2 instance profiles. Instead, Lambda functions directly assume an IAM execution role configured during function creation, which provides the necessary permissions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.