A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account. Which solutions will provide the Lambda function this access? (Select TWO)
Show Answer & Explanation
Correct Answers: C. Create an IAM role for the Lambda function. Attach an IAM policy that al-lows access to the S3 bucket.; D. Create an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access. Specify the function's IAM role as the principal.
Why C is correct: Creating an IAM role for the Lambda function and attaching an IAM policy that allows S3 access is the AWS best practice. Lambda functions should use IAM roles (execution roles) rather than embedding credentials. The role is automatically assumed by Lambda at runtime, providing temporary credentials through AWS STS.Why D is correct: This is another valid approach using resource-based policies. You can create an IAM role for Lambda and then use an S3 bucket policy that explicitly allows that role (as the principal) to access the bucket. This demonstrates cross-service authorization using resource-based policies combined with identity-based roles.Why A is wrong: Storing access keys in environment variables is a security anti-pattern. It exposes long-term credentials that could be compromised. AWS explicitly recommends against embedding credentials in code or configuration.Why B is wrong: EC2 key pairs are used for SSH access to EC2 instances, not for AWS API authentication. This answer confuses instance access with service-to-service authentication. Lambda doesn't use SSH keys to communicate with S3.Why E is wrong: Security groups control network traffic (layer 3/4), not API access to S3. S3 access requires IAM permissions, not network security groups. Additionally, Lambda functions in VPC can have security groups, but this doesn't grant S3 API permissions.