DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an IAM role with a trust policy that allows Lambda to assume it, and attach a permissions policy granting DynamoDB access.

  Why this is correct

  The standard and most secure method for a Lambda function to interact with other AWS services, such as DynamoDB, is by assuming an IAM execution role. This role requires a trust policy allowing `lambda.amazonaws.com` to assume it, and an attached permissions policy explicitly granting the necessary DynamoDB actions. This mechanism provides temporary, scoped credentials, adhering to the principle of least privilege and ensuring secure access.

• ✗

  Create an IAM user and store the access keys in the Lambda environment variables.

  Why it's wrong here

  Storing IAM user access keys directly in Lambda environment variables is a severe security anti-pattern. These long-term credentials, if compromised, grant persistent access to resources and violate the principle of least privilege. AWS Lambda functions should instead leverage IAM execution roles, which automatically provide temporary, rotated credentials, eliminating the need to manage static access keys and significantly reducing security risks.

• ✗

  Attach a resource-based policy to the Lambda function that grants DynamoDB access.

  Why it's wrong here

  Resource-based policies define permissions for *other* AWS services or accounts to access a specific resource, such as allowing S3 to invoke a Lambda function. However, Lambda functions do not use resource-based policies to define their *outbound* permissions for accessing other AWS services like DynamoDB. Instead, a Lambda function's ability to call external services is governed exclusively by its assigned IAM execution role.

• ✗

  Use the Lambda function's default VPC role to access DynamoDB via a VPC endpoint.

  Why it's wrong here

  Lambda functions do not possess a 'default VPC role'; an explicit IAM execution role must always be configured to grant permissions for any AWS service interaction. While a Lambda function can be configured to operate within a VPC and utilize VPC endpoints for private connectivity to DynamoDB, the authorization to perform actions on DynamoDB still originates from its assigned execution role, not a non-existent VPC-specific role.

Go deeper

Related to this question