DVA-C02 Exam - Question 100

Question

A company uses AWS Lambda functions and an Amazon S3 trigger to process images into an S3 bucket. A development team set up multiple environments in a single AWS account.

After a recent production deployment, the development team observed that the development S3 buckets invoked the production environment Lambda functions. These invocations caused unwanted execution of development S3 files by using production Lambda functions. The development team must prevent these invocations. The team must follow security best practices.

Which solution will meet these requirements?

Examice · Accepted Answer

To prevent unwanted invocations and follow security best practices, the development and production environments should be moved into separate AWS accounts. This strategy establishes strong isolation boundaries, enhancing security, billing, and access controls. Adding a resource policy to each Lambda function to allow only S3 buckets that are within the same account to invoke the function further ensures that S3 events in the development environment cannot trigger production Lambda functions and vice versa. This method effectively separates workloads and mitigates the risk of cross-environment triggers.

AgboolaKun · Answer

B is a wrong answer because I do not understand the need to move the environments to separate AWS accounts. The resource policy in the production environment can be used to control which S3 bucket invokes the function.

In my understanding, the answer choice C fulfills the security best practices requirement in the question.

csG13 · Answer

I choose B because it says that the team should follow the best security practices. AWS well-architected framework suggests separation. For reference see the link below: https://wa.aws.amazon.com/wat.question.SEC_1.en.html

Rameez1 · Answer

Moving the Dev and Prod environments to separate Accounts will make them totally isolated with cross account Lambda invocations. Whereas in Option C though Prod Lambda won't trigger with Dev S3 bucket Event, Dev Lambda may still get mistakenly invoked by Prod S3 Bucket event and perform unwanted actions.

SD_CS · Answer

I initially thought C, but after going through the below, I dont think there is any scope for doubt.

stablish common guardrails and isolation between environments (such as production, development, and test) and workloads through a multi-account strategy. Account-level separation is strongly recommended, as it provides a strong isolation boundary for security, billing, and access

https://docs.aws.amazon.com/en_us/wellarchitected/latest/framework/sec_securely_operate_multi_accounts.html

Certified101 · Answer

B - following best practices

KarBiswa · Answer

I feel it is D as there is no doubt we need to separately create two accounts for DEV & PROD. After that there must lambda execution roles where we can the specific policies. Resource based policies more of a Cross Account access.
https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html
https://repost.aws/knowledge-center/lambda-execution-role-s3-bucket
As the question demands the best practices scenario so option D fulfils that.

fossil123 · Answer

C meets the contextual security requirements.

Millie024 · Answer

B seems to be the correct one
https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_securely_operate_multi_accounts.html
Establish common guardrails and isolation between environments (such as production, development, and test) and workloads through a multi-account strategy. Account-level separation is strongly recommended, as it provides a strong isolation boundary for security, billing, and access.

Nagasoracle · Answer

Answer : A
As it mentions to follow best security practice

Nagasoracle · Answer

Sorry it is B
As it mentions to follow security practice

tqiu654 · Answer

ChatGPT: B

Mimi666 · Answer

Keeping the security best-practices.

[Removed] · Answer

OMG this questions can be very wordy... be careful and read carefully - Answer is C

rrshah83 · Answer

new accounts not necessary...

SerialiDr · Answer

This approach involves configuring a resource-based policy (also known as a Lambda function policy) that explicitly defines which resources (in this case, S3 buckets) can invoke the Lambda function. By specifying only the production S3 bucket in the resource policy of the production Lambda function, you ensure that only events from the designated production S3 bucket can trigger the production Lambda function. This prevents development or other non-production buckets from inadvertently invoking production Lambda functions, thus maintaining environment integrity and security best practices.

65703c1 · Answer

B is the correct amswer.

Aws_aspr · Answer

Asked 18 July 24 WIthout security best practices word. So C is correct answer for this.

DVA-C02 Exam - Question 100

Discussion