Exams / DVA-C02 / IAM roles, policies and STS / Question 2
DVA-C02 practice question: IAM roles, policies and STS (2 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A developer writes an AWS CloudFormation template that creates an S3 bucket, a Lambda function and an event notification that sends object-created events from the bucket to the function. What must the template also contain so that Amazon S3 is allowed to invoke the function?
Choose one answer.
- AA. A statement in the function's execution role that allows lambda:InvokeFunction.
- BB. A bucket policy that allows the function's execution role to call s3:GetObject.
- CC. A statement in the function's execution role that allows s3:PutBucketNotification.
- DD. An AWS::Lambda::Permission resource allowing s3.amazonaws.com to invoke the function.
Show the answer and explanation
Answer: D
- A. Wrong: The execution role controls what the function can do. It does not let other services call the function.
- B. Wrong: This lets the function read objects. It does not let S3 invoke the function.
- C. Wrong: This is the permission to configure notifications, needed by whoever sets them up, not by the function.
- D. Right: Correct. This adds a statement to the function's resource-based policy that lets the S3 service invoke it.
Explanation
A Lambda function has two kinds of policy. The execution role governs what the function may do. The resource-based policy governs who may invoke it. Push sources such as S3 need a resource-based policy statement naming the service principal, ideally limited by source ARN or source account.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.