SCS-C02 · Question #475
A company's developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions in production…
The correct answer is D. Use SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig. Using Service Control Policies (SCPs) in AWS Organizations to deny the lambda:CreateFunctionUrlConfig and actions with the lambda:FunctionUrlAuthType condition key set to NONE will prevent the deployment of lambda:UpdateFunctionUrlConfig unauthenticated Lambda function URLs in…
Question
A company's developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions in production accounts. The company wants to meet this requirement by using AWS Organizations. The solution must not require additional work for the developers. Which solution will meet these requirements?
Options
- ARequire the developers to configure all function URL to support cross-origin resource sharing
- BUse an AWS WAF delegated administrator account to view and block unauthenticated access to
- CUse SCPs to allow all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig
- DUse SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig
How the community answered
(37 responses)- A3% (1)
- B5% (2)
- C11% (4)
- D81% (30)
Explanation
Using Service Control Policies (SCPs) in AWS Organizations to deny the lambda:CreateFunctionUrlConfig and actions with the lambda:FunctionUrlAuthType condition key set to NONE will prevent the deployment of lambda:UpdateFunctionUrlConfig unauthenticated Lambda function URLs in production accounts. By enforcing this policy at the organization level, developers are automatically restricted from deploying unauthenticated functions, requiring no additional configuration or oversight from them. This solution effectively meets the security requirement without adding operational overhead.
Topics
Community Discussion
No community discussion yet for this question.