An application uses an Amazon SQS queue and two AWS Lambda functions. One of the Lambda functions pushes messages to the queue, and the other function polls the queue and receives queued messages. A s

Question

Options

• AAttach an IAM policy to the SQS queue that grants the Lambda function principals read and write
• BAttach a resource-based policy to the SQS queue to deny read and write access to the queue for
• CAttach a resource-based policy to the SQS queue that grants the Lambda function principals read
• DAttach a resource-based policy to the SQS queue to deny all access to the queue. Attach an IAM

• A
  17% (7)
• B
  10% (4)
• C
  71% (30)
• D
  2% (1)

Explanation

To ensure that only specific AWS Lambda functions can read from or write to an Amazon SQS queue, useresource-based policiesattached directly to the SQS queue. These policies explicitly grant permissions to the IAM roles used by the Lambda functions. Additionally, the Lambda execution roles must also have IAM policies that permit SQS access. This dual-layer approach follows the AWS security best practice of granting least privilege access and ensures that no other service or entity can interact with the queue. This is a common and supported pattern documented in theAmazon SQS Developer Guide, where resource-based policies restrict access at the queue level while IAM roles control permissions at the function level.

No community discussion yet for this question.