Q2 — AWS SAA-C03 Ch.14

Question 2 of 100 | ← Chapter 14

Q1002. A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI).The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the application has the necessary permissions to publish messages securely to the SNS topic.Which combination of steps will meet these requirements? (Choose three.)

• A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic. ✓
• B. Use server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.
• C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions. ✓
• D. Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy.
• E. Associate an Amazon API Gateway HTTP API with the SNS topic to control access to the topic by using API Gateway resource policies.
• F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS. ✓

Correct Answer: A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic., C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions., F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.

Explanation

To ensure that an AWS Lambda function can securely publish notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic using AWS KMS customer managed keys, the following combination of steps will meet the requirements:A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.Explanation of Each Step:A. Create a resource policy for the SNS topic: This policy allows the Lambda function to have the necessary permissions to publish messages to the SNS topic. It specifies which principals (in this case, the Lambda function) can interact with the SNS topic.C. Create a resource policy for the encryption key: This policy ensures that the Lambda function has the necessary permissions to use the KMS key for encryption. Without this, the Lambda function may not be able to encrypt the messages it sends to the SNS topic.F. Configure a Lambda execution role: The execution role assigned to the Lambda function must have permissions that allow it to use the customer managed key in AWS KMS. This includes policies for both the KMS key and the SNS topic.Evaluation of Other Options:B. Use server-side encryption with AWS KMS keys (SSE-KMS): While using SSE-KMS is good practice, the requirement specifies the use of customer managed keys. This option does not address the permissions needed for the Lambda function.D. Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy: While this can be part of the resource policy, it is not a standalone step. It is implicitly covered in option A.E. Associate an Amazon API Gateway HTTP API with the SNS topic: This is not required for the use case described. The Lambda function can publish directly to the SNS topic without needing an API Gateway intermediary.In summary, the correct steps to ensure the Lambda function can securely publish messages to the SNS topic while adhering to the security and compliance requirements are A, C, and F.