DVA-C02 · Question #98
A developer has created an AWS Lambda function to provide notification through Amazon Simple Notification Service (Amazon SNS) whenever a file is uploaded to Amazon S3 that is larger than 50 MB. The d
The correct answer is B. The resource-based policy for the Lambda function does not have the required permissions to be. When S3 invokes a Lambda function via event notification, the Lambda resource-based policy must explicitly grant s3.amazonaws.com permission to invoke the function. Without this, S3 cannot trigger the function regardless of file size.
Question
A developer has created an AWS Lambda function to provide notification through Amazon Simple Notification Service (Amazon SNS) whenever a file is uploaded to Amazon S3 that is larger than 50 MB. The developer has deployed and tested the Lambda function by using the CLI. However, when the event notification is added to the S3 bucket and a 3,000 MB file is uploaded, the Lambda function does not launch. Which of the following is a possible reason for the Lambda function's inability to launch?
Options
- AThe S3 event notification does not activate for files that are larger than 1,000 MB.
- BThe resource-based policy for the Lambda function does not have the required permissions to be
- CLambda functions cannot be invoked directly from an S3 event.
- DThe S3 bucket needs to be made public.
How the community answered
(34 responses)- A3% (1)
- B79% (27)
- C6% (2)
- D12% (4)
Why each option
When S3 invokes a Lambda function via event notification, the Lambda resource-based policy must explicitly grant s3.amazonaws.com permission to invoke the function. Without this, S3 cannot trigger the function regardless of file size.
S3 event notifications have no file size restriction; they trigger on object creation regardless of object size.
S3 event notifications invoke Lambda by calling the Lambda API on behalf of the S3 service principal. For this cross-service invocation to succeed, the Lambda function's resource-based policy must include a statement granting s3.amazonaws.com the lambda:InvokeFunction action. Even if the Lambda execution role is correctly configured, the missing resource-based policy permission will silently prevent S3 from launching the function.
Lambda functions can and routinely are invoked directly from S3 events; this is a core supported integration pattern.
Making the S3 bucket public controls object access for end users, not the ability of S3 to invoke a Lambda function.
Concept tested: Lambda resource-based policy for S3 invocation
Source: https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html
Community Discussion
No community discussion yet for this question.