Q1Identity and Access Management
A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy: Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?
← → navigate · a answer
Community votes
Discussion · 6
C 2
Selected Answer: C
Need permission to read the objects in the policy /*
C 2
Selected Answer: C
C is correct. The principal is fine because it follows the principle of least privilege by limiting the condition to the Lambda's ARN.
C 1
Selected Answer: C
obviuse
C 1
Selected Answer: C
It's C
C 1
Selected Answer: C
s3:GetObject → requires bucket/*
C 1
Selected Answer: C
Answer C is correct, but it is not enough. I do not think allowing the Lambda service principal can grant the Lambda function access to the S3 bucket. The principal should be the Lambda function's role ARN, I think.