Q39 — AWS SAA-C03 Ch.15

Question 39 of 100 | ← Chapter 15

Q1139. An application uses an Amazon SQS queue and two AWS Lambda functions. One of the Lambda functions pushes messages to the queue, and the other function polls the queue and receives queued messages.A solutions architect needs to ensure that only the two Lambda functions can write to or read from the queue.Which solution will meet these requirements?

• A. Attach an IAM policy to the SQS queue that grants the Lambda function principals read and write access. Attach an IAM policy to the execution role of each Lambda function that denies all access to the SQS queue except for the principal of each function.
• B. Attach a resource-based policy to the SQS queue to deny read and write access to the queue for any entity except the principal of each Lambda function. Attach an IAM policy to the execution role of each Lambda function that allows read and write access to the queue. ✓
• C. Attach a resource-based policy to the SQS queue that grants the Lambda function principals read and write access to the queue. Attach an IAM policy to the execution role of each Lambda function that allows read and write access to the queue.
• D. Attach a resource-based policy to the SQS queue to deny all access to the queue. Attach an IAM policy to the execution role of each Lambda function that grants read and write access to the queue.

Correct Answer: B. Attach a resource-based policy to the SQS queue to deny read and write access to the queue for any entity except the principal of each Lambda function. Attach an IAM policy to the execution role of each Lambda function that allows read and write access to the queue.

Explanation

The solution that will ensure that only the two Lambda functions can write to or read from the Amazon SQS queue is:B. Attach a resource-based policy to the SQS queue to deny read and write access to the queue for any entity except the principal of each Lambda function. Attach an IAM policy to the execution role of each Lambda function that allows read and write access to the queue.Explanation:Resource-Based Policy: By attaching a resource-based policy to the SQS queue, you can explicitly deny access to any entity that is not one of the specified Lambda function principals. This ensures that only the designated Lambda functions can interact with the queue.IAM Policy for Lambda Execution Roles: By allowing the execution role of each Lambda function to have access to the queue, you ensure that they can perform the necessary actions (read and write) while maintaining a secure configuration.Why Other Options Are Not Suitable:A: This option suggests using an IAM policy to deny access, which is not the most effective way to control access at the queue level since it may not prevent unauthorized entities from attempting to access the queue.C: While granting access to the Lambda function principals is important, simply granting access without explicitly denying other entities does not provide the same level of security.D: Denying all access at the resource level without proper IAM policies could lead to the Lambda functions being unable to access the queue, as the execution role would need to match the resource policy to grant access.Thus, option B provides the most secure and effective solution for restricting access to the SQS queue to only the specified Lambda functions.