Examkin

Question

Difficulty: EasyServerless Development with AWS Lambda

A developer is deploying a new AWS Lambda function that reads data from an Amazon DynamoDB table. What is the AWS-recommended best practice for authorizing the Lambda function to perform this action?

  1. A
    Add the DynamoDB read permissions directly to the trust policy of the Lambda function's IAM execution role to allow the function to perform actions on the table.
  2. Assign an IAM execution role to the Lambda function with a permission policy that grants DynamoDB read access, and initialize the AWS SDK client without specifying static credentials.Answer
  3. C
    Embed the AWS access key ID and secret access key directly in the Lambda function's source code during the initialization of the AWS SDK client.
  4. D
    Configure the Lambda function's environment variables to store the AWS access key ID and secret access key, and load them into the AWS SDK client at runtime.

Answer

Assign an IAM execution role to the Lambda function with a permission policy that grants DynamoDB read access, and initialize the AWS SDK client without specifying static credentials.
The correct approach is to assign an IAM execution role to the AWS Lambda function. The permission policy attached to this role should grant the minimum required permissions (such as read access to the specific DynamoDB table). When the Lambda function runs, the AWS SDK automatically retrieves temporary security credentials provided by the execution role. This avoids the need to manage or store long-lived AWS credentials in the function code or configuration.

Step-by-Step Solution

1
Create an IAM role for the AWS Lambda function.
The Lambda service is allowed to assume the role via the role's trust policy.
This establishes the identity that the Lambda function will use when executing.
2
Attach a permission policy to the IAM role that allows the required DynamoDB read actions.
The role is granted permission to perform read operations on the target table.
This follows the principle of least privilege by explicitly allowing only the necessary database access.
3
Associate the IAM role with the Lambda function and initialize the AWS SDK client using its default configuration.
The AWS SDK automatically retrieves and uses the temporary credentials generated when Lambda assumes the role.
This eliminates the need to distribute, store, or manage long-lived AWS access keys.

Key Concept

IAM Execution Role and AWS SDK Default Credential Provider Chain
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic