A security engineer discovers that the Lambda function is failing to create the report. The security engineer must implement a solution that corrects the issue and provides least privilege…

Question

Options

• ACreate a resource based policy that allows Security Hub access to the ARN of the Lambda
• BAttach the AWSSecurityHubReedOnlyAccess AWS managed policy to the Lambda function's
• CGrant the Lambda function s execution role read-only permissions to access Amazon Inspector
• DCreate a custom IAM policy that grants the Security Hub Get*, List*, Batch*, and Describe*

• A
  8% (5)
• B
  5% (3)
• C
  69% (43)
• D
  18% (11)

Explanation

Option C is correct because the Lambda function needs to read data from Amazon Inspector to generate its report, and the proper mechanism for granting an AWS Lambda function access to other AWS services is through its execution role - not resource-based policies. Granting read-only permissions satisfies the least-privilege requirement since report generation only requires reading, not writing.

Why the distractors are wrong:

• A is incorrect because a resource-based policy allowing Security Hub to invoke Lambda fixes invocation permissions, not the Lambda's ability to read Inspector data - it solves the wrong problem in the wrong direction.
• B is incorrect because AWSSecurityHubReadOnlyAccess grants access to Security Hub, not Amazon Inspector, which is the service the Lambda actually needs to query for report data.
• D is incorrect because using wildcard actions like Get*, List*, Batch*, Describe* grants far broader permissions than a report-generating function needs, violating the least-privilege principle - and it targets Security Hub rather than Inspector.

Memory tip: Think "Lambda reads Inspector → execution role needs Inspector read access." Anytime a Lambda calls another AWS service, the fix lives in the execution role, and for least privilege, match the permission scope to the action (read-only for read-only tasks).

No community discussion yet for this question.