A Lambda function must read objects from one specific S3 bucket and nothing else. What is the MOST secure way to grant this access?
A.Attach the AdministratorAccess managed policy to the Lambda execution role
AdministratorAccess violates least privilege and grants far more than needed.
B.Create an IAM role with a policy allowing s3:GetObject on that bucket's resources and assign it to the function
Correct. A scoped execution role provides temporary, least-privilege credentials.
C.Embed an IAM user's access key in the function's environment variables
Embedding access keys creates long-lived credentials that can leak and are hard to rotate.
D.Make the S3 bucket public and use unsigned requests
Public buckets remove access control entirely and expose the data to anyone.
Why this answer
Lambda functions should assume an IAM execution role scoped to least privilege. Granting s3:GetObject on the specific bucket ARN (and its object ARN) gives the function only the access it needs, and credentials are delivered via temporary role credentials rather than long-lived keys.
Correct answer: B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM & Access Control practice session.
Practice IAM & Access Control