DVA-C02 Question 102

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  B) Eliminated - CloudFront functions are lightweight JavaScript functions designed for simple HTTP request and response manipulations (e.g., header rewrites, URL rewrites). They cannot access AWS services like STS or assume roles C/D) Eliminated - Moving the credentials from the JSON file to the Lambda@Edge function does not eliminate the core issue of hardcoding credentials

• Chose A1

  A is the correct answer.

• Chose A3

  Why A is Correct: Lambda@Edge for Secure Credential Management: Lambda@Edge allows you to run Lambda functions in response to CloudFront events. By using Lambda@Edge, the developer can securely manage credentials by keeping them out of the client-side code. Invoking on Viewer Request: Invoking the Lambda@Edge function on viewer requests ensures that the credential generation happens in real-time, securely, and as needed, without exposing any sensitive information. Execution Role with STS Access: Assigning the Lambda function an execution role with permissions to access AWS STS (Security Token Service) enables the function to securely request temporary, limited-privilege credentials on behalf of the client. Moving SDK Calls to Lambda@Edge: Transferring all AWS SDK calls from the frontend to the Lambda@Edge function prevents exposing any credentials in the frontend code, enhancing security.