Which statement correctly separates a Lambda function's execution role from its resource-based policy?
A.Execution role controls who can invoke it; resource policy controls what AWS resources it can call
Exactly backwards.
B.Execution role grants the function access to AWS services; resource policy controls which principals may invoke the function
Correct — outbound permissions vs inbound invocation permission.
C.Both do the same thing — use whichever is simpler
They're complementary layers, not interchangeable.
D.Resource policies are only for cross-account VPC access
Resource policies govern invocation, unrelated to VPC.
Why this answer
Execution role = outbound (what the function code may call — S3, DynamoDB, etc.). Resource-based policy = inbound (which services/accounts may invoke it — e.g., allow S3 events or API Gateway to trigger it).
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security