DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless application using AWS Lambda. The function needs to access an S3 bucket to read a configuration file. What is the best way to provide the Lambda function with the bucket name?
⚠ Common exam trap
The trap here is that candidates may overcomplicate the solution by choosing KMS encryption (Option D) or the circular dependency of reading from the same bucket (Option C), when the simplest and most secure approach—environment variables—is the correct answer for decoupling configuration from code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the bucket name in an environment variable for the Lambda function.
AWS Lambda environment variables provide a secure, configurable, and decoupled way to pass the S3 bucket name to the function without hardcoding it in the code. This follows the principle of infrastructure as code and allows the same function code to be reused across different environments (e.g., dev, staging, prod) by simply changing the environment variable value. Environment variables are encrypted at rest by default using AWS KMS, ensuring the bucket name is not exposed in plaintext within the code repository.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the bucket name in the Lambda function code.
Why it's wrong here
Hardcoding the S3 bucket name directly into the Lambda function's source code creates significant inflexibility. This approach necessitates a code change and redeployment every time the target bucket needs to be updated, such as when moving between development, testing, and production environments, each potentially using a different S3 bucket. It violates the principle of separation of concerns, making configuration management cumbersome and prone to errors.
- ✓
Store the bucket name in an environment variable for the Lambda function.
Why this is correct
Storing the S3 bucket name in an environment variable is the recommended and most efficient method for passing configuration data to an AWS Lambda function. Environment variables are easily configured through the AWS Management Console, CLI, or Infrastructure as Code tools like CloudFormation or Terraform, allowing updates without modifying or redeploying the function's code. This promotes separation of configuration from code, enhances flexibility across different deployment environments, and improves operational agility.
- ✗
Read the bucket name from a text file stored in the same bucket.
Why it's wrong here
Attempting to read the S3 bucket name from a text file stored within the *same* S3 bucket creates an unresolvable circular dependency. For the Lambda function to initiate an S3 `getObject` API call to retrieve the configuration file, it must first know the target bucket's name. If that essential piece of information is contained within the very file it's trying to retrieve from that bucket, the initial S3 API request cannot be formed, preventing the function from ever starting its operation.
- ✗
Use a KMS key to encrypt the bucket name and decrypt it in the function.
Why it's wrong here
Using an AWS Key Management Service (KMS) key to encrypt and then decrypt an S3 bucket name within the Lambda function introduces unnecessary complexity and cost for a non-sensitive configuration parameter. While KMS is crucial for protecting highly sensitive data, a bucket name typically does not require this level of encryption. This approach adds latency due to decryption calls on every invocation, incurs KMS API charges, and complicates IAM permissions, making it an overly elaborate solution for simple configuration.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.