DVA-C02 Deployment Practice Question
A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint and a Lambda function. The developer wants to ensure that the Lambda function can be invoked only by the API Gateway and not directly. Which configuration should be used?
⚠ Common exam trap
Candidates often confuse resource-based policies with VPC-based controls, often selecting `aws:SourceVpce` (Option C) thinking API Gateway invokes Lambda through a VPC endpoint, but API Gateway uses a public endpoint or private integration without a VPC endpoint for Lambda invocation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a resource-based policy with 'aws:SourceArn' condition set to the API Gateway ARN.
Adding a resource-based policy with an `aws:SourceArn` condition set to the API Gateway ARN ensures that the Lambda function can only be invoked by that specific API Gateway. This uses the AWS Identity and Access Management (IAM) condition key to restrict the `lambda:InvokeFunction` action based on the ARN of the invoking resource, preventing direct invocation from other sources like the AWS CLI or SDK.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a VPC endpoint policy that allows only API Gateway.
Why it's wrong here
Configuring a VPC endpoint policy controls which principals can access services exposed via that specific VPC endpoint. This policy does not, however, directly govern the authorization for a Lambda function's invocation. While API Gateway might use a VPC endpoint for private integrations, this policy would not restrict the direct invocation of the Lambda function itself from API Gateway, as it operates at the network access layer for the endpoint, not the application-level authorization for the function call.
- ✗
Add a resource-based policy with 'aws:SourceAccount' condition.
Why it's wrong here
Adding an `aws:SourceAccount` condition to a Lambda resource-based policy only ensures that the invocation request originates from within the specified AWS account. This condition is too broad and does not provide the necessary granularity to restrict invocations specifically to API Gateway. Any IAM user, role, or other AWS service within that account with `lambda:InvokeFunction` permissions could still invoke the Lambda function, bypassing the intended API Gateway access path.
- ✗
Add a resource-based policy with 'aws:SourceVpce' condition set to the API Gateway VPC endpoint ID.
Why it's wrong here
The `aws:SourceVpce` condition is designed to restrict access to a resource based on the specific VPC endpoint ID through which the request originated. While API Gateway can integrate with private resources via VPC endpoints, the invocation of a Lambda function by API Gateway typically occurs directly over the public AWS service endpoints, not through a customer-managed VPC endpoint that would make `aws:SourceVpce` applicable for restricting the source of the Lambda invocation itself. Therefore, this condition is not suitable for securing Lambda invocations from API Gateway.
- ✓
Add a resource-based policy with 'aws:SourceArn' condition set to the API Gateway ARN.
Why this is correct
Adding a resource-based policy with an `aws:SourceArn` condition set to the specific API Gateway ARN is the most effective and secure method to restrict Lambda function invocation. This policy ensures that only requests originating from that particular API Gateway instance (e.g., `arn:aws:execute-api:region:account-id:api-id/*/*`) are authorized to invoke the Lambda function. This fine-grained control prevents unauthorized direct invocations of the Lambda function, enforcing that all traffic must flow through the API Gateway.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.