Examkin

Question

Difficulty: MediumAWS Serverless Application Model (SAM)

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The template defines an AWS::Serverless::Function resource that needs to read and write items in an Amazon DynamoDB table defined in the same template. During initial testing, the function fails to access the table due to missing permissions. The developer wants to resolve this issue by applying the principle of least privilege using the most operationally efficient method that native AWS SAM features support. Which configuration should the developer add to the template to resolve the permission issue?

  1. Add the Policies property to the AWS::Serverless::Function resource and reference the DynamoDBCrudPolicy policy template, passing the name of the DynamoDB table as a parameter.Answer
  2. B
    Add an AssumeRolePolicyDocument property to the function's properties that grants dynamodb:PutItem and dynamodb:GetItem permissions, listing the DynamoDB service principal dynamodb.amazonaws.com as the trusted entity.
  3. C
    Create a separate standard AWS CloudFormation AWS::IAM::Role resource with the required DynamoDB permissions and attach it to the function, and remove the Transform: AWS::Serverless-2016-10-31 line from the top of the template to avoid resource parsing conflicts.
  4. D
    Store the required IAM policy JSON statement in AWS Systems Manager Parameter Store as a SecureString parameter, and use a dynamic reference in the function's Role property to fetch and apply the policy at runtime.

Answer

Add the Policies property to the AWS::Serverless::Function resource and reference the DynamoDBCrudPolicy policy template, passing the name of the DynamoDB table as a parameter.
The correct answer provides the most secure and operationally efficient configuration. Specifying the DynamoDBCrudPolicy policy template under the Policies property of the AWS::Serverless::Function resource allows SAM to generate a scoped IAM policy for the function that only permits read/write actions on the designated DynamoDB table.

Step-by-Step Solution

1
Analyze the permission requirements for the Lambda function.
The function requires read and write (CRUD) operations on a specific DynamoDB table.
This establishes the scope of permissions needed to satisfy the principle of least privilege.
2
Evaluate the native AWS SAM features for handling function permissions.
AWS SAM provides built-in policy templates (such as DynamoDBCrudPolicy) that allow developers to reference pre-defined permission scopes with minimal configuration.
Using native policy templates reduces template complexity compared to writing custom IAM policies.
3
Apply the policy template in the function's Properties block.
The DynamoDBCrudPolicy is added under the Policies attribute, specifying the target TableName.
This automatically creates the execution role with the correct permissions scoped only to the target table.

Key Concept

AWS SAM Policy Templates
Estimated Time:1m 30s
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic