DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A policy that includes 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:*' on the bucket.

  Why it's wrong here

  This policy is insufficient because it omits the 'logs:CreateLogGroup' permission, which is necessary for the Lambda service to establish a dedicated log group for the function if one does not already exist. Furthermore, granting 's3:*' on the bucket provides overly broad permissions, including actions like 'PutObject' or 'DeleteObject', which are not required for a function that merely processes an existing object. This violates the principle of least privilege, as only 's3:GetObject' is functionally needed.

• ✗

  A policy that includes 'logs:*' and 's3:*' on the bucket.

  Why it's wrong here

  This policy uses wildcards for both logging and S3 permissions, granting excessive privileges that violate the principle of least privilege. 'logs:*' allows actions like deleting log groups or cancelling export tasks, far beyond what's needed for basic logging. Similarly, 's3:*' grants full administrative control over the S3 bucket, including write and delete operations, when the function only requires read access to an object. Such broad permissions increase the security risk and potential attack surface for the Lambda function.

• ✗

  A policy that includes 'logs:PutLogEvents' and 's3:ListBucket' on the bucket.

  Why it's wrong here

  This policy is critically flawed because it lacks essential permissions for both logging and S3 object processing. It omits 'logs:CreateLogGroup' and 'logs:CreateLogStream', which are fundamental for Lambda to initialize its logging infrastructure in CloudWatch. Additionally, 's3:ListBucket' only permits listing the contents of a bucket; the function requires 's3:GetObject' to actually retrieve and read the data of the specific S3 object it is intended to process.

• ✓

  A policy that includes 'logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:GetObject' on the specific bucket.

  Why this is correct

  This policy correctly adheres to the principle of least privilege by granting only the necessary permissions for a Lambda function to process an S3 object and log its execution. 'logs:CreateLogGroup' allows the function to create its dedicated log group, 'logs:CreateLogStream' enables the creation of log streams within that group, and 'logs:PutLogEvents' permits writing runtime logs to CloudWatch. 's3:GetObject' is the precise permission required to retrieve the S3 object's content, ensuring the function can perform its core task securely.