DVA-C02 Question 165

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  (CD) eliminated. service-based link is not supported by Lambda. (A) S3 ListBucket permission violates the principle of least privilege and therefore is not the most secure. Bucket policy to list principles of multiple accounts requires additional overhead. The list can change. (B) allows the CloudFormation service role to access the S3 bucket from any account, as long as it has the S3 GetObject permission. The bucket policy grants access to any principal with the GetObject permission, which is the least privilege needed to deploy the Lambda code.

• Chose A1

  A is the correct answer.

• Chose A4

  This approach is secure and provides a granular level of control. By granting the CloudFormation service role in each account the necessary S3 permissions and specifying the account numbers in the S3 bucket policy, you ensure that only the specified accounts can access the Lambda code. However, the ListBucket permission is not necessary if the CloudFormation template already knows the exact S3 object key.