These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-002
A Lambda function needs to write inquiry data to a DynamoDB table. Which IAM policy best follows the principle of least privilege?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: D. Allow only dynamodb:PutItem on the target table.
Explanation
If Lambda only saves inquiries, the least-privilege approach is to allow only PutItem on the target DynamoDB table.
Per-choice explanations
A. Attach AdministratorAccess to the Lambda execution role.
Incorrect. AdministratorAccess is far too broad.
B. Store DynamoDB access keys in Lambda environment variables.
Incorrect. Storing AWS credentials in environment variables should be avoided. Use the Lambda execution role instead.
C. Allow dynamodb:* on all DynamoDB tables.
Incorrect. dynamodb:* grants excessive permissions.
D. Allow only dynamodb:PutItem on the target table.
Correct. It limits the policy to the target table and the required action.
Practical Use
The IAM policy attached to a Lambda execution role should be limited to the actions and target resources that the function actually needs, following the principle of least privilege. For a function that only writes inquiries to a specific DynamoDB table, the appropriate policy limits Action to `dynamodb:PutItem` only and Resource to the ARN of the target table only. Granting `dynamodb:*` or AdministratorAccess greatly expands the blast radius if the function is compromised, so avoid them. A common antipattern in practice is storing AWS access keys (long-term IAM user credentials) in Lambda environment variables. Because Lambda can automatically receive temporary credentials through the execution role, there is no need to embed long-term keys in code or environment variables. Long-term keys also create rotation overhead on leakage and make tracking with IAM Access Analyzer or CloudTrail more difficult. Even when combined with Secrets Manager or Parameter Store, the basic principle is to limit stored secrets to external systems (such as database DSNs or external API keys) and leave AWS authentication to the role. On SAA-C03, recurring perspectives include "least privilege," "IAM role vs access keys," and "narrowing Resource to the ARN level." Distractor patterns include wildcard Actions, AdministratorAccess, and storing access keys in Lambda environment variables, all of which conflict with least privilege and best practices and can be eliminated. More advanced questions also cover restricting to a source VPC endpoint or requiring MFA with Conditions, or monitoring actual used permissions with IAM Access Analyzer.