Examkin

Soru

Zorluk: OrtaData Store Operations with Amazon DynamoDB

A developer is building an AWS Lambda function that retrieves customer order history from an Amazon DynamoDB table. The orders are retrieved based on a specific `CustomerID` and filtered by order status. To connect to the database, the developer has hardcoded the access keys of an IAM user directly inside the Lambda function's code. During load testing, the application experiences high latency and receives `ProvisionedThroughputExceededException` errors when retrieving orders, even though the total read capacity units (RCU) of the table are not fully utilized. The logs indicate that the application is performing a sequential `Scan` operation to find the customer's records. Which two actions should the developer take to resolve these security and performance issues? (Select TWO.)

  1. Perform a `Query` operation instead of a `Scan` operation, specifying the `CustomerID` as the partition key in the key condition expression.Cevap
  2. Remove the hardcoded IAM user access keys from the function code, assign an IAM execution role with the required DynamoDB permissions to the Lambda function, and rely on the default SDK credential provider chain to assume the role.Cevap
  3. C
    Apply a filter expression on `CustomerID` while keeping the `Scan` operation to reduce the number of Read Capacity Units (RCUs) consumed by the database.
  4. D
    Store the IAM user access keys in an Amazon S3 bucket, and configure the Lambda function to download and load them into the environment variables at startup.
  5. E
    Enable strongly consistent reads on the `Scan` operation to improve retrieval performance and decrease the overall RCU consumption.

Cevap

Perform a Query operation instead of a Scan operation, specifying the CustomerID as the partition key in the key condition expression, and remove the hardcoded IAM user access keys from the function code, assign an IAM execution role with the required DynamoDB permissions to the Lambda function, and rely on the default SDK credential provider chain.
Querying by partition key directly locates the customer's orders, significantly reducing latency and RCU usage. Removing hardcoded keys and using an IAM execution role is the recommended security practice for AWS Lambda.

Adım Adım Çözüm

1
Analyze performance bottleneck
The application uses a Scan operation with a filter expression, which reads the entire table and discards non-matching items, wasting RCUs and causing latency/throttling.
To fix this, the developer must switch to a Query operation which directly targets the specific CustomerID partition key.
2
Analyze security issue
The developer has hardcoded long-term IAM access keys inside the Lambda code, which violates AWS security best practices.
The developer must remove these keys and associate an IAM execution role with DynamoDB permissions to the Lambda function, letting the SDK dynamically fetch temporary credentials.

Anahtar Kavram

Using Query instead of Scan for key-based retrieval, and utilizing Lambda execution roles for secure AWS service access.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Data Store Operations with Amazon DynamoDB

Bu konudan daha fazla soru