IAM & Access Control

IAM users, roles, policies, least privilege, MFA, and cross-account access patterns.

Domain 1: Design Secure Architectures · 30% of exam · 6 questions

Question 1 of 6 · keys: 1–5 select, Enter submit, ← → navigate

Domain 1: Design Secure ArchitecturesIAM & Access ControleasySingle choice

A Lambda function must read objects from one specific S3 bucket and nothing else. What is the MOST secure way to grant this access?

Attach the AdministratorAccess managed policy to the Lambda execution roleCreate an IAM role with a policy allowing s3:GetObject on that bucket's resources and assign it to the functionEmbed an IAM user's access key in the function's environment variablesMake the S3 bucket public and use unsigned requests