DVA-C02 SAM Policy Templates Practice Question
A developer is building a serverless application using AWS SAM. The application includes a Lambda function that needs read-only access to an S3 bucket. The developer wants to use SAM's built-in policy templates to grant this permission. Which policy template should be used in the SAM template?
⚠ Common exam trap
Many exam-takers confuse S3CrudPolicy with read-only access, but CRUD implies full data manipulation (create, read, update, delete), which is more permissive than the required read-only scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3ReadPolicy
The S3ReadPolicy template is the correct choice because it grants read-only access to an S3 bucket, which aligns with the requirement for the Lambda function. AWS SAM provides this built-in IAM policy template to simplify attaching least-privilege permissions, specifically allowing s3:GetObject, s3:ListBucket, and similar read operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
S3ReadPolicy
Why this is correct
The S3ReadPolicy template grants a Lambda function the necessary `s3:GetObject` permission to retrieve specific objects and `s3:ListBucket` to enumerate the contents of a designated S3 bucket. This adheres strictly to the principle of least privilege, ensuring the application can only perform read operations without any ability to modify or delete data. It is the most appropriate choice for scenarios requiring only data retrieval from S3.
- ✗
S3CrudPolicy
Why it's wrong here
The S3CrudPolicy template provides a broader set of permissions, including `s3:GetObject` and `s3:ListBucket` for reading, but critically also `s3:PutObject` for creating or updating objects, and `s3:DeleteObject` for removing them. While it encompasses read functionality, granting these create, update, and delete capabilities is excessive and introduces unnecessary security risks when the requirement is strictly read-only access. This violates the principle of least privilege by providing more access than needed.
- ✗
S3FullAccessPolicy
Why it's wrong here
The S3FullAccessPolicy template grants comprehensive control over S3 resources, typically encompassing all `s3:*` actions. This includes not only object-level operations like reading, writing, and deleting, but also bucket-level actions such as creating, deleting, and configuring buckets, and managing bucket policies or access points. Such extensive permissions are far beyond a simple read-only requirement, posing a significant security vulnerability by allowing unrestricted manipulation of S3 resources.
- ✗
S3StreamPolicy
Why it's wrong here
The S3StreamPolicy is designed for specific event-driven architectures, primarily enabling a Lambda function to process events originating from an S3 bucket, such as object creation or deletion notifications. It typically grants permissions to interact with event sources or receive notifications, rather than direct `s3:GetObject` or `s3:ListBucket` permissions for general data retrieval. This policy is not suitable for an application that needs to directly query and read existing objects from an S3 bucket on demand, as its purpose is to react to changes, not to browse or fetch data.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.