A developer is implementing an AWS Lambda function that will read data from an Amazon DynamoDB table.What is the most secure method of providing the Lambda function access permissions to the DynamoDB table?
Click on the arrows to vote for the correct answer
A. B. C. D. E.Answer: D.
Option A is incorrect because you do not assign IAM roles to DynamoDB tables.
Option B is incorrect because this is not the optimal solution.It requires sharing of user access keys, which is not the best security practice.Changing secret access keys or user IDs would require additional operational overhead or code changes.
Option C is incorrect because there are no DynamoDB usernames and passwords.
Option D is CORRECT because the best security practice for access control to DynamoDB tables is to use IAM policies and IAM roles.The role then needs to be assigned to the Lambda Execution Role.An AWS Lambda function's execution role grants the function permission to access other AWS services and resources.
Option E is incorrect because the Lambda function policy defines which AWS resources are allowed to invoke the Lambda function.
Reference:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/best-practices-security-preventative.html https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-overview.htmlThe most secure method of providing the Lambda function access permissions to the DynamoDB table is option A: Create an IAM role, create an IAM policy granting necessary access permissions from AWS Lambda, assign the IAM policy to the IAM role, and assign the IAM role to the DynamoDB table.
Here is a detailed explanation of this option:
Create an IAM role: An IAM role is an AWS identity that you can create in your account that has specific permissions. It is a secure way to grant permissions to entities in your account, such as AWS services or applications. In this case, the Lambda function will assume this role to access the DynamoDB table.
Create an IAM policy: An IAM policy is a document that defines permissions. It specifies what actions are allowed or denied on specific AWS resources. In this case, you need to create an IAM policy that grants necessary access permissions from AWS Lambda to access the DynamoDB table.
Assign the IAM policy to the IAM role: After you have created the IAM policy, you need to assign it to the IAM role that you created earlier. This ensures that the Lambda function will have the necessary permissions to access the DynamoDB table.
Assign the IAM role to the DynamoDB table: Once the IAM role has been created and the policy assigned to it, you need to assign the IAM role to the DynamoDB table. This ensures that the Lambda function will be able to access the table.
Option B is not the best solution as it involves creating an IAM user with access keys, which could potentially be compromised. Option C is also not the best solution as it involves creating a DynamoDB username and password, which could also be compromised.
Option D is a possible solution, but it assigns the IAM role to the Lambda execution role, which is not as secure as assigning the IAM role to the DynamoDB table directly.
Option E is not the best solution as it assigns the IAM policy directly to the Lambda function policy, which could potentially give the Lambda function access to more resources than it needs.