AWS Certified Developer Associate · Free Practice Question Hard
Question 5
An application that runs on AWS Lambda requires access to specific highly confidential objects in an Amazon S3 bucket. In accordance with the principle of least privilege, a company grants access to the S3 bucket by using only temporary credentials. How can a developer configure access to the S3 bucket in the MOST secure way?
- A Create a secret access key and access key ID with permission to access the S3 bucket. Store the key and key ID as environment variables in Lambda. Use the environment variables to access the required S3 objects.
- B Hardcode the credentials that are required to access the S3 objects in the application code. Use the credentials to access the required S3 objects.
- C Create a Lambda function execution role. Attach a policy to the role that grants access to specific objects in the S3 bucket.
- D Create a secret access key and access key ID with permission to access the S3 bucket. Store the key and key ID in AWS Secrets Manager. Configure the application to retrieve the Secrets Manager secret and use the credentials to access the S3 objects.
Reveal correct answer
Correct answer: A
Explanation
To ensure the most secure access to specific highly confidential objects in an Amazon S3 bucket for an AWS Lambda application, a developer should create a Lambda function execution role and attach a policy to the role that grants access to the specific objects in the S3 bucket. This approach adheres to the principle of least privilege and avoids the security risks associated with hardcoding credentials or storing them in environment variables or AWS Secrets Manager.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
