DVA-C02 Security Practice Question
A developer is creating a Lambda function that requires access to a DynamoDB table. The function will be invoked by an Amazon API Gateway REST API. What is the BEST way to secure this architecture?
⚠ Common exam trap
Test-takers frequently confuse resource-based policies (used for granting invocation permissions to other AWS accounts or services) with execution roles (used for granting the Lambda function permissions to access other AWS resources), leading them to incorrectly choose Option B or think Option C is a valid authentication method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role for the Lambda function with a policy granting access to the DynamoDB table.
The Lambda function needs an execution role—an IAM role that Lambda assumes at runtime—with a policy that grants the specific DynamoDB actions (e.g., GetItem, PutItem) on the target table. This follows the principle of least privilege and is the standard AWS pattern for granting Lambda access to AWS resources. API Gateway invokes the Lambda function via a resource-based policy on the function itself, but that does not affect DynamoDB access; the Lambda execution role handles all downstream permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role for the Lambda function with a policy granting access to the DynamoDB table.
Why this is correct
Creating an IAM role for the Lambda function is the standard and most secure method for granting AWS service permissions. This role provides temporary, automatically rotated credentials to the Lambda execution environment, allowing it to assume the specified permissions. By attaching an identity-based policy that grants specific `dynamodb:` actions on the target table, the Lambda function adheres to the principle of least privilege, accessing only what it needs.
- ✗
Attach a resource-based policy to the DynamoDB table allowing Lambda access.
Why it's wrong here
DynamoDB does not support resource-based policies, which are policies directly attached to a resource (like an S3 bucket or SQS queue) to control who can access it. Instead, DynamoDB access control is primarily managed through identity-based policies attached to IAM users or roles, or through fine-grained access control using AWS Lake Formation for specific data lake scenarios. Therefore, attempting to attach a resource-based policy directly to a DynamoDB table for Lambda access is not a valid configuration option within AWS.
- ✗
Use API Gateway to pass a shared secret to Lambda for DynamoDB access.
Why it's wrong here
Using API Gateway to pass a shared secret for DynamoDB access is highly insecure and not a recommended practice. Secrets passed through API Gateway could be exposed in request logs, network traffic, or client-side code, creating a significant security vulnerability. Furthermore, shared secrets lack proper rotation mechanisms and audit trails, making them difficult to manage securely and trace access, which contradicts AWS's security best practices for credential management.
- ✗
Store the DynamoDB access keys in the Lambda environment variables.
Why it's wrong here
Storing DynamoDB access keys directly in Lambda environment variables is an insecure practice that should be avoided. These static credentials, if compromised, grant persistent access to the DynamoDB table and lack automatic rotation, posing a significant security risk. AWS Lambda functions should leverage their assigned IAM execution role, which provides temporary, automatically rotated credentials through the AWS Security Token Service (STS), eliminating the need to hardcode sensitive access keys.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.