Back to AWS Lambda

AWS Lambda Permission Model

5 minutes 5 Questions

AWS Lambda Permission Model is a set of Identity and Access Management (IAM) policies that define and control the permissions required for a Lambda function to access AWS resources as well as to be accessed by other resources. This includes execution role policies that grant the necessary permissio…

Test mode:
Start practice test
AWS Certified Solutions Architect - AWS Lambda Permission Model Example Questions

Test your knowledge of AWS Lambda Permission Model

Question 1

Your Lambda function requires temporary access to another AWS service. Which of these methods should you use to grant temporary access to the required service?

Correct Answer: Assume an IAM role with the required permissions within the Lambda function

To grant temporary access to another service from a Lambda function, assume an IAM role with the required permissions within the Lambda function. This allows for secure and temporary access to the necessary resources without embedding access keys or exposing resources directly.

Question 2

You are designing an application which uses AWS Lambda to process data from multiple sources. You want to ensure that the Lambda function has the necessary permissions to process the data. Which method should you use to grant the Lambda function the required permissions?

Correct Answer: Attach an IAM role to the Lambda function

When granting permissions to a Lambda function, the best practice is to attach an IAM role to it. This method allows the function to automatically assume the permissions defined in the role without embedding any access keys in the code or creating separate users for each data source.

Question 3

You configured an Amazon SQS queue as an event source for an AWS Lambda function. The function processes each message and writes the result to a specific Amazon S3 bucket. Following the principle of least privilege, which permissions must be included in the Lambda function’s execution role?

Correct Answer: Attach the AWSLambdaBasicExecutionRole managed policy and an inline policy that allows s3:PutObject to the specific S3 bucket; no SQS permissions are required in the function’s execution role when using an SQS event source mapping.

When an Amazon SQS queue is configured as an event source for AWS Lambda, the Lambda service polls the queue and handles message retrieval and deletion on your behalf. Therefore, the function’s execution role does not need SQS permissions. The execution role is used by the function code when calling other AWS services; in this scenario it must be able to write objects to the target S3 bucket. Following least privilege, grant s3:PutObject only (scoped to the specific bucket and prefix as appropriate) and include the AWSLambdaBasicExecutionRole managed policy so the function can write logs to CloudWatch. Granting SQS permissions or broad S3 permissions (such as S3FullAccess) is unnecessary and over-privileged.

More AWS Lambda Permission Model questions
18 questions (total)
Start 18 question test