IAM Quiz
You have created an AWS Lambda function that will write data to a DynamoDB table. Which of the following must be in place to ensure that the Lambda function can interact with the DynamoDB table?
A.
Ensure an IAM Role is attached to the Lambda function which has the required DynamoDBprivileges.
B.
Ensure an IAM User is attached to the Lambda function which has the required DynamoDB privileges.
C.
Ensure the Access keys are embedded in the AWS Lambda function.
D.
Ensure the IAM user password is embedded in the AWS Lambda function.
A. Ensure an IAM Role is attached to the Lambda function which has the required DynamoDB privileges.
AWS Documentation mentions the following to support this requirement:
Each Lambda function has an IAM role (execution role) associated with it. You specify the IAM role when you create your Lambda function. Permissions you grant to this role determine what AWS Lambda can do when it assumes the role. There are two types of permissions that you grant to the IAM role:
If your Lambda function code accesses other AWS resources, such as to read an object from an S3 bucket or write logs to CloudWatch Logs, you need to grant permissions for relevant Amazon S3 and CloudWatch actions to the role.
If the event source is stream-based (Amazon Kinesis Data Streams and DynamoDB streams), AWS Lambda polls these streams on your behalf. AWS Lambda needs permissions to poll the stream and read new records on the stream so you need to grant the relevant permissions to this role.
For more information on the Permission Role model for AWS Lambda, please refer to the URL below.
https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html
