Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 1 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 1
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account.
Which solutions will provide the Lambda function this access? (Choose two.)

A. Create an IAM user that has only programmatic access. Create a new access key pair. Add environmental variables to the Lambda function with the access key ID and secret access key. Modify the Lambda function to use the environmental variables at run time during communication with Amazon S3.
B. Generate an Amazon EC2 key pair. Store the private key in AWS Secrets Manager. Modify the Lambda function to retrieve the private key from Secrets Manager and to use the private key during communication with Amazon S3.
C. Create an IAM role for the Lambda function. Attach an IAM policy that allows access to the S3 bucket.
D. Create an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access. Specify the function's IAM role as the principal.
E. Create a security group. Attach the security group to the Lambda function. Attach a bucket policy that allows access to the S3 bucket through the security group ID.

Show Suggested Answer

Suggested Answer: CD 🗳️

by RayHK at Oct. 4, 2023, 2:44 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Raphaello

Highly Voted 1 year, 6 months ago

CD Why the answers for many questions are categorically wrong?

upvoted 7 times

5pqo3pqn1l

6 days, 18 hours ago

thanks valid information Ref - https://bitly.cx/o2VIQ

upvoted 1 times

...

PrabhuKK

Most Recent 3 months, 1 week ago

Selected Answer: CD

C. IAM role for Lambda with policy: This is the most common and recommended approach. You create an IAM role specifically for the Lambda function, then attach an IAM policy to the role that grants the necessary read and write permissions to the S3 bucket. Lambda functions assume this role when they are executed and can then interact with the S3 bucket. D. IAM role for Lambda with a bucket policy: Another valid approach is to create an IAM role for the Lambda function and attach a bucket policy to the S3 bucket that allows access from the Lambda function's role. The bucket policy explicitly grants access to the function's role, so no IAM role-specific permissions are needed for the Lambda function itself, although this option is less common than the previous one.

upvoted 2 times

...