Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A solutions architect is configuring a new AWS Lambda function that must read data from an Amazon DynamoDB table. According to AWS security best practices, how should the solutions architect grant the Lambda function the necessary permissions to access the table?

  1. Create an IAM execution role with a permissions policy that allows read access to the DynamoDB table, and associate this role with the Lambda function.Answer
  2. B
    Configure the Lambda function to execute using the AWS account root user credentials to ensure that database access is never blocked by permission changes.
  3. C
    Create an IAM user with DynamoDB read permissions, generate long-term access keys, and store them as a plain text string in Systems Manager Parameter Store for the Lambda function to retrieve.
  4. D
    Create individual IAM users for each corporate identity, and configure the Lambda function to authenticate against the database using these federated user credentials.

Answer

Create an IAM execution role with a permissions policy that allows read access to the DynamoDB table, and associate this role with the Lambda function.
The correct answer is correct because configuring an IAM execution role and attaching it to the Lambda function allows the function to securely assume the role at runtime. This provides the function with temporary credentials via AWS STS and follows the principle of least privilege without managing static credentials.

Step-by-Step Solution

1
Create an IAM execution role with a trust policy that allows the AWS Lambda service to assume the role.
The Lambda service gains the capability to dynamically assume the role and request temporary security credentials.
AWS services must establish a trust relationship before they can assume an identity and access other resources.
2
Attach a permissions policy to the IAM role that grants read-only access (such as GetItem or Query actions) to the target DynamoDB table.
The role is granted the minimum necessary permissions required to read data from the database.
Restricting access to only the required resource and actions adheres to the security principle of least privilege.
3
Associate the execution role with the configuration of the Lambda function.
When the Lambda function is invoked, AWS securely injects temporary credentials representing the role into the execution environment.
This eliminates the need to hardcode or manually retrieve long-term access keys, significantly reducing the credential exposure risk.

Key Concept

AWS Lambda execution roles permit service-to-service authorization using temporary credentials rather than long-term access keys.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic