ExamPark
Course menuDVA-C03

Exams / DVA-C03 / IAM roles, policies and STS / Question 2

DVA-C03 practice question: IAM roles, policies and STS (2 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A developer defines an S3 bucket, a Lambda function and the bucket's object-created notification in one AWS CloudFormation template.

The function's execution role already has every permission the function needs at run time, but Amazon S3 is not yet allowed to start the function, so the notification cannot be set up.

What should the developer add to the template?

Choose one answer.

  1. A. A statement in the function's execution role that allows the S3 service to call lambda:InvokeFunction on the function's ARN.
  2. B. An AWS::Lambda::EventSourceMapping resource that links the bucket to the function and the event types it should handle.
  3. C. An AWS::Lambda::Permission resource that lets s3.amazonaws.com invoke the function, limited to this bucket and account.
  4. D. A bucket policy statement that allows the function's execution role to call s3:GetObject on every object in the bucket.
Show the answer and explanation

Answer: C

  • A. Wrong: The execution role is what the function assumes while it runs, so it controls what the function can call, not who can start it. Permission to invoke a function is granted on the function itself through a resource-based policy. Learn more: Lambda resource-based policies (opens in a new tab)
  • B. Wrong: Event source mappings are used for services that Lambda polls, such as SQS queues, Kinesis streams and DynamoDB streams. S3 pushes notifications to the function instead, so it needs an invoke permission rather than a mapping.
  • C. Right: Correct. This adds a resource-based policy statement to the function with the S3 service as principal. Adding the source ARN and account conditions means only this bucket in this account can start the function. Learn more: Lambda resource-based policies (opens in a new tab)
  • D. Wrong: That lets the function read objects once it is running, which is a different problem. It does not give S3 permission to start the function, so the notification is still rejected.

Explanation

S3 pushes events to Lambda, so the function needs a resource-based policy that names the S3 service as the principal; in CloudFormation that is an AWS::Lambda::Permission resource. Conditions on the source ARN and account stop other buckets from invoking the function. Execution role statements and bucket policies control other directions of access.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice IAM roles, policies and STSAll IAM roles, policies and STS questions

Want more on IAM roles, policies and STS? The 5 full-length practice sets have 15 more IAM roles, policies and STS questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets