Q91 — AWS SAA-C03 Ch.13

Question 91 of 100 | ← Chapter 13

Q991. A company is building an application on AWS. The application uses multiple AWS Lambda functions to retrieve sensitive data from a single Amazon S3 bucket for processing. The company must ensure that only authorized Lambda functions can access the data. The solution must comply with the principle of least privilege.Which solution will meet these requirements?

Correct Answer: C. Create individual IAM roles for each Lambda function. Grant the IAM roles access to the S3 bucket.Assign each IAM role as the Lambda execution role for its corresponding Lambda function.

Explanation

To ensure that only authorized AWS Lambda functions can access sensitive data in a single Amazon S3 bucket while complying with the principle of least privilege, the best solution is:C. Create individual IAM roles for each Lambda function. Grant the IAM roles access to the S3 bucket. Assign each IAM role as the Lambda execution role for its corresponding Lambda function.Explanation:Individual IAM Roles: By creating separate IAM roles for each Lambda function, you can grant only the specific permissions needed for each function to access the S3 bucket. This approach adheres to the principle of least privilege, ensuring that each function has only the permissions necessary for its operation.Lambda Execution Role: Assigning the appropriate IAM role as the execution role for each Lambda function allows for fine-grained control over what each function can access. This setup minimizes the risk of unauthorized access to sensitive data.Evaluation of Other Options:A. Grant full S3 bucket access to all Lambda functions through a shared IAM role: This option violates the principle of least privilege, as it grants all functions full access to the S3 bucket, regardless of whether they need it.B. Configure the Lambda functions to run within a VPC...: While restricting access based on VPC endpoint IP addresses could work, it adds unnecessary complexity and does not directly enforce permissions at the IAM level.D. Configure a bucket policy granting access to the Lambda functions based on their function ARNs: While this approach can control access, it can become cumbersome to manage as the number of functions increases. It is generally more manageable to use IAM roles for individual functions for permission control.In summary, Option C is the most effective and secure solution for managing access to the S3 bucket while following the principle of least privilege.