SCS-C02 Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Attach a public IP to the Lambda function and use an IAM role with DynamoDB permissions.

  Why it's wrong here

  Attaching a public IP to a Lambda function is not a supported operation; AWS Lambda only assigns private IPs from the VPC subnet to its hyperplane ENIs, and those functions have no direct route to the internet even if an IAM role trusts them. DynamoDB's public endpoint is only reachable via a NAT gateway/NAT instance or a VPC endpoint, so merely pairing a public IP with DynamoDB permissions would not establish connectivity. IAM authorizes the API calls, but it does not create a network path when the function is isolated in a private subnet.

• ✗

  Create an API Gateway REST API with a VPC link and DynamoDB integration.

  Why it's wrong here

  An API Gateway REST API with a VPC link is designed to route requests to private resources behind an Application or Network Load Balancer inside a VPC, not to AWS managed services like DynamoDB. To have API Gateway call DynamoDB directly, you would use an AWS service integration with a role that allows the API to invoke DynamoDB, completely bypassing Lambda. Adding Lambda to this flow would require writing a custom integration or proxy, so the VPC link adds irrelevant networking complexity and does not solve the Lambda-to-DynamoDB access requirement.

• ✗

  Use a resource-based policy on the DynamoDB table allowing access from the Lambda function's ARN.

  Why it's wrong here

  DynamoDB is an AWS managed service that uses IAM identity-based policies on the principal (the Lambda execution role) to control access; it does not accept resource-based policies akin to an S3 bucket policy. A resource-based policy cannot be attached to a table to whitelist a Lambda function's ARN, and even if it could, such an IAM mechanism would only authorize requests—it would not provide the missing network path if the Lambda is VPC-isolated. Permissions for DynamoDB actions such as GetItem and PutItem must be attached to the IAM role that the function assumes at runtime.

• ✓

  Create a VPC endpoint for DynamoDB and attach an IAM execution role to the Lambda function with the necessary permissions.

  Why this is correct

  Creating a gateway VPC endpoint for DynamoDB gives the Lambda function's subnet a private route to the DynamoDB service, avoiding the public internet and any need for a NAT gateway. The Lambda execution role should carry an identity policy with the specific DynamoDB actions and resource (table ARN) so the function is both network-reachable and authorized to perform the operation. This combines the correct network path with the correct IAM authorization, and the endpoint works through a route-table prefix list rather than an ENI in the function's subnet.

Go deeper

Related to this question