DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add a policy to the Lambda execution role allowing dynamodb:GetItem.

  Why it's wrong here

  Adding dynamodb:GetItem to the Lambda execution role grants the function permission to retrieve items from a DynamoDB table. However, this permission only covers data access and does not inherently include the necessary authorization to decrypt data encrypted with AWS Key Management Service (KMS). To access encrypted data, the Lambda's execution role must also be explicitly granted kms:Decrypt permissions by the KMS key policy associated with the DynamoDB table's encryption key.

• ✓

  Add a policy to the KMS key that allows the Lambda execution role to perform kms:Decrypt.

  Why this is correct

  The KMS key policy must allow the Lambda execution role to perform kms:Decrypt. This is required because DynamoDB uses server-side encryption with KMS, and the service needs to decrypt data on behalf of the Lambda function.

• ✗

  Configure a VPC endpoint for DynamoDB.

  Why it's wrong here

  Configuring a VPC endpoint for DynamoDB establishes a private connection between your VPC and the DynamoDB service, enhancing security by keeping traffic within the AWS network. While essential for private connectivity and compliance, a VPC endpoint is a network configuration and does not provide any authorization or decryption capabilities. It merely facilitates the secure communication channel; the permissions to access and decrypt data are still governed by IAM policies and KMS key policies.

• ✗

  Modify the Lambda function to call KMS Decrypt API.

  Why it's wrong here

  Modifying the Lambda function to directly call the KMS Decrypt API is an incorrect approach because DynamoDB's server-side encryption with KMS is a fully managed feature. When a Lambda function, with the appropriate IAM and KMS key permissions, requests encrypted data from DynamoDB, the DynamoDB service automatically handles the decryption process on the function's behalf. Direct decryption calls from the application layer are unnecessary, introduce complexity, and bypass the integrated, secure workflow provided by AWS services.