DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use the Lambda function's execution role to grant full administrative access to DynamoDB.

  Why it's wrong here

  Granting full administrative access to DynamoDB via the Lambda function's execution role is a severe security misconfiguration. This approach violates the principle of least privilege, as the function would possess permissions far beyond what is necessary to process messages, creating a significant attack surface. If the Lambda function were compromised, an attacker could potentially gain control over all DynamoDB tables in the account, leading to data exfiltration or destruction.

• ✗

  Store the AWS access key and secret access key as environment variables in the Lambda function.

  Why it's wrong here

  Storing AWS access keys and secret access keys directly in Lambda environment variables is highly insecure and strongly discouraged. These static credentials could be inadvertently exposed through logs, code repositories, or if the Lambda function's configuration is accessed. This practice bypasses AWS's secure credential management mechanisms and creates a hardcoded dependency, making credential rotation difficult and increasing the risk of unauthorized access to AWS resources.

• ✓

  Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.

  Why this is correct

  Assigning an IAM role to the Lambda function with a precisely scoped policy is the secure and recommended method for granting AWS service permissions. This approach leverages temporary credentials automatically managed by AWS, eliminating the need to store static access keys. The IAM policy can be crafted to adhere strictly to the principle of least privilege, allowing the function only the specific DynamoDB actions (e.g., dynamodb:PutItem, dynamodb:GetItem) on designated resources it requires to perform its task.

• ✗

  Create an IAM user with DynamoDB access and use its credentials in the Lambda function.

  Why it's wrong here

  Creating an IAM user and embedding its long-lived credentials within a Lambda function is an anti-pattern for service-to-service communication. IAM users are primarily designed for human interaction or programmatic access from external applications where roles are not feasible. Using an IAM user for a Lambda function introduces static, long-lived credentials that must be securely stored and rotated manually, which is less secure and more operationally complex than leveraging temporary credentials provided by an IAM role.

Go deeper

Related to this question