DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an IAM user and provide the credentials to the Lambda function.

  Why it's wrong here

  Creating an IAM user and embedding its long-term credentials directly within a Lambda function is a significant security anti-pattern. AWS Lambda functions are designed to leverage IAM roles, which provide temporary, automatically rotated credentials through the AWS Security Token Service (STS). Storing static IAM user access keys and secret keys in code or environment variables introduces a high risk of credential compromise and violates the principle of least privilege by not using temporary, scoped permissions.

• ✗

  Attach a resource-based policy to the S3 bucket.

  Why it's wrong here

  While resource-based policies on an S3 bucket can grant permissions, they define *who can access the resource* rather than *what the Lambda function itself is allowed to do*. For a Lambda function to perform actions, it needs an associated execution role with an identity-based policy that grants it permissions to *make requests* to services like S3. A resource policy alone would not provide the Lambda function with the necessary permissions to initiate API calls; it only dictates if a *specific principal* (which would still be the Lambda's execution role) is allowed access once it makes a request.

• ✗

  Attach a policy to an IAM group and add the Lambda function to the group.

  Why it's wrong here

  IAM groups are specifically designed to manage permissions for collections of *IAM users*, simplifying the assignment of common policies. Lambda functions, however, are compute resources that assume an IAM *role* for their execution permissions and are not considered IAM principals that can be added as members to an IAM group. This approach fundamentally misapplies the purpose of IAM groups, which are not intended for service principals like Lambda functions.

• ✓

  Create an IAM role with the necessary permissions and assign it to the Lambda function as the execution role.

  Why this is correct

  This is the correct and AWS-recommended approach for granting permissions to a Lambda function. An IAM role, configured with a trust policy allowing `lambda.amazonaws.com` to assume it, serves as the function's execution role. An attached identity-based permissions policy then explicitly defines the specific actions the Lambda function is authorized to perform, such as `s3:GetObject` for read-only access, ensuring adherence to the principle of least privilege and providing temporary credentials.

Go deeper

Related to this question