DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads stored in an S3 bucket. The developer needs to ensure that the Lambda function can read objects from the S3 bucket. Which TWO steps should the developer take to meet this requirement? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a bucket policy on the S3 bucket that grants access to the Lambda function's execution role.
To allow the Lambda function to read objects from S3, the developer must attach an IAM policy to the Lambda execution role that includes the s3:GetObject permission (Option D). Additionally, an S3 bucket policy can be used to explicitly grant access to the Lambda function's execution role (Option C). This provides cross-account access if needed. Option A is incorrect because S3 object-level permissions are not set directly on objects; instead, bucket policies or IAM policies control access. Option B is incorrect because AWS KMS is used for encryption key management, not for granting access to S3. Option E is incorrect because Lambda functions use execution roles, not IAM users, to obtain permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the S3 bucket's object-level permissions to allow the Lambda function.
Why it's wrong here
Object-level permissions (an S3 object ACL) govern which AWS accounts or users can access an individual object, but they cannot grant cross-account access to a Lambda function's execution role. Lambda does not use object ACLs to authorize API calls; S3 evaluates the requester's IAM identity via the execution role and the bucket policy. Since you cannot attach an ACL directly to a Lambda role, this approach fails to establish the necessary identity-based authorization.
- ✗
Use AWS Key Management Service (KMS) to grant the Lambda function access to the S3 bucket.
Why it's wrong here
AWS KMS is a service for creating and controlling customer master keys used to encrypt data at rest; it does not provide S3 access control or an authorization mechanism for Lambda to read objects. While you may need a KMS key policy to allow Lambda to decrypt objects if the bucket uses SSE-KMS, KMS permissions supplement, not replace, S3 and IAM permissions. This option conflates encryption key management with access management, so it cannot grant the required s3:GetObject permission.
- ✓
Add a bucket policy on the S3 bucket that grants access to the Lambda function's execution role.
Why this is correct
Because the Lambda function and the S3 bucket reside in different accounts (or because the bucket owner controls the resource), a bucket policy on the S3 bucket is the resource-based policy that can explicitly grant the Lambda execution role's ARN permission to s3:GetObject. S3 evaluates both the identity-based policy on the principal (the Lambda role) and the resource-based policy, and a statement in the bucket policy that allows the role's ARN satisfies the resource authorization. This is the recommended way to enable cross-account or cross-service access because it does not require creating or rotating IAM users.
- ✓
Attach an IAM policy to the Lambda execution role with permissions for s3:GetObject.
Why this is correct
Attaching an IAM policy to the Lambda execution role grants the role the s3:GetObject permission, which is the identity-based side of the access control. For the call to succeed, S3 must approve not only this identity-based policy but also any applicable resource-based policy, such as a bucket policy, if the bucket is in a different account. In the same-account scenario, this alone is often sufficient, but when a cross-account bucket policy is required, both policies must allow the action; this option correctly addresses the Lambda side of the permission.
- ✗
Create an IAM user with S3 read permissions and configure the Lambda function to assume that user.
Why it's wrong here
IAM users are long-term credentials intended for human users or applications with static keys, not for AWS services like Lambda. Lambda functions cannot 'assume' an IAM user; they assume an IAM role via the service's execution role mechanism, and the STS AssumeRole action would be required, which user credentials cannot natively provide. Using an IAM user would also require embedding long-lived access keys in the function, violating the security best practice of using roles and temporary credentials, and it does not solve the resource-based policy requirements.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.