DVA-C02 · Question #453
A developer is creating a solution to track an account's Amazon S3 buckets over time. The developer has created an AWS Lambda function that will run on a schedule. The function will list the account's
The correct answer is B. Permission for the Lambda function to list buckets in Amazon S3 C. Permission for the Lambda function to write in DynamoDB. The Lambda execution role needs explicit permissions to perform the actions the function takes: listing S3 buckets and writing items to DynamoDB.
Question
A developer is creating a solution to track an account's Amazon S3 buckets over time. The developer has created an AWS Lambda function that will run on a schedule. The function will list the account's S3 buckets and will store the list in an Amazon DynamoDB table. The developer receives a permissions error when the developer runs the function with the AWSLambdaBasicExecutionRole AWS managed policy. Which combination of permissions should the developer use to resolve this error? (Choose two.)
Options
- ACross-account IAM role
- BPermission for the Lambda function to list buckets in Amazon S3
- CPermission for the Lambda function to write in DynamoDB
- DPermission for Amazon S3 to invoke the Lambda function
- EPermission for DynamoDB to invoke the Lambda function
How the community answered
(43 responses)- A5% (2)
- B79% (34)
- D12% (5)
- E5% (2)
Why each option
The Lambda execution role needs explicit permissions to perform the actions the function takes: listing S3 buckets and writing items to DynamoDB.
A cross-account IAM role is unnecessary because the Lambda function and both services (S3 and DynamoDB) reside in the same AWS account.
The s3:ListAllMyBuckets (or s3:ListBuckets) permission must be attached to the Lambda execution role so the function can enumerate S3 buckets; AWSLambdaBasicExecutionRole only grants CloudWatch Logs access.
The dynamodb:PutItem (or dynamodb:BatchWriteItem) permission must also be attached so the function can persist the bucket list to the DynamoDB table.
Permissions for S3 to invoke Lambda are used for S3 event triggers; the function is not being triggered by S3 here.
DynamoDB does not invoke Lambda functions in this scenario; the function writes to DynamoDB, so the permission must be on the Lambda role, not on DynamoDB.
Concept tested: IAM execution role permissions for Lambda accessing S3 and DynamoDB
Source: https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html
Community Discussion
No community discussion yet for this question.