DVA-C02 · Question #669
A developer is building an application that uses an AWS Lambda function. The Lambda function requires access to an Amazon DynamoDB table. The function also needs to send logs to Amazon CloudWatch…
The correct answer is C. Create an execution role that has the required permissions for DynamoDB and CloudWatch Logs. Attaching a dedicated IAM execution role to the Lambda function with the minimal permissions needed to read/write the DynamoDB table and to create log streams and put log events in CloudWatch Logs follows AWS best practices. This ensures that the function has only the…
Question
A developer is building an application that uses an AWS Lambda function. The Lambda function requires access to an Amazon DynamoDB table. The function also needs to send logs to Amazon CloudWatch Logs. Which solution will meet these requirements in the MOST secure way?
Options
- ACreate a resource policy that includes the required permissions for DynamoDB and CloudWatch
- BCreate a permissions boundary that includes the required permissions for DynamoDB and
- CCreate an execution role that has the required permissions for DynamoDB and CloudWatch Logs.
- DCreate an IAM user that has the required permissions for DynamoDB and CloudWatch Logs.
How the community answered
(44 responses)- A2% (1)
- B2% (1)
- C95% (42)
Explanation
Attaching a dedicated IAM execution role to the Lambda function with the minimal permissions needed to read/write the DynamoDB table and to create log streams and put log events in CloudWatch Logs follows AWS best practices. This ensures that the function has only the privileges it requires and does so without embedding long-term credentials or using less appropriate IAM constructs.
Community Discussion
No community discussion yet for this question.