A Lambda function needs to read items from a DynamoDB table. What's the correct way to grant the function access — following least-privilege?
A.Embed AWS access keys in the function code
Hardcoded keys are a critical security anti-pattern.
B.Attach an IAM execution role with DynamoDB read permissions on that table
Correct. IAM roles provide temporary, scoped credentials automatically.
C.Store credentials in environment variables
Env vars leak credentials into config and are still a manual key pattern.
D.Make the DynamoDB table publicly readable
There's no 'public' DynamoDB read — access always goes through IAM.
Why this answer
Lambda runs under an IAM execution role. Grant that role scoped DynamoDB permissions (e.g., dynamodb:GetItem on the specific table ARN) — never embed credentials in code or environment variables.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security