How to configure S3 read access in AWS SAM?

DVA-C02 By islever Editorial Last updated Aug 31, 2026

Short answer

D Add the S3ReadPolicy template to the Lambda function's execution role.

Question

A developer is automating a new application deployment with AWS Serverless Application Model (AWS SAM). The new application has one AWS Lambda function and one Amazon S3 bucket. The Lambda function must access the S3 bucket to only read objects. How should the developer configure AWS SAM to grant the necessary read privilege to the S3 bucket?

Reference a second Lambda authorizer function.
Add a custom S3 bucket policy to the Lambda function.
Create an Amazon Simple Queue Service (SQS) topic for only S3 object reads. Reference the topic in the template.
Add the S3ReadPolicy template to the Lambda function's execution role. Correct Answer

Key Takeaways

This question tests knowledge of AWS SAM policy templates versus manual IAM configuration, with the trap being the confusion between resource-based policies (bucket policies) and identity-based policies (execution roles).

To grant a Lambda function read access to an S3 bucket using AWS SAM, developers should utilize the framework's built-in policy templates. The community consensus confirms that attaching the S3ReadPolicy to the function's execution role is the standard and most efficient method.

Common mistake: Choosing to add a custom S3 bucket policy (Option B) is a common mistake because, while it can restrict access, AWS SAM is designed to simplify permission management by attaching managed policies directly to the Lambda execution role.

Expert Analysis

Why the Answer Is Correct

Option D is correct because AWS SAM provides pre-defined policy templates, such as S3ReadPolicy, which automatically generate the necessary IAM permissions for a Lambda execution role. This method adheres to the principle of least privilege by granting only read access (specifically s3:Get*) to the specified S3 bucket. It simplifies the infrastructure code significantly compared to writing raw IAM policy documents from scratch.

Why the Other Options Are Wrong

Option A is incorrect because Lambda authorizers are used for controlling access to API Gateway endpoints, not for granting S3 object permissions. Option B is incorrect or less optimal because while bucket policies are valid for S3 access control, SAM specifically streamlines permission management via the execution role's Policies property. Option C is incorrect because Amazon SQS is a messaging service and does not serve as a mechanism to grant S3 read permissions to a Lambda function.

Community Comment Notes

Community comments strongly support Option D, emphasizing that AWS SAM simplifies infrastructure-as-code deployments by offering these pre-defined templates. Users noted that coupling the S3 permissions directly with the Lambda role is the intended design pattern in SAM, avoiding the complexity of custom bucket policies.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see 'AWS SAM' and 'permissions' in a question, always look for options involving SAM-specific policy templates or the Policies property in the function definition. Avoid manual bucket policies or unrelated services like SQS unless the scenario specifically requires cross-account access not covered by standard templates.

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

examuserss 👍 1 Answered D

The correct answer is D. AWS SAM simplifies infrastructure-as-code deployments. To grant the Lambda function read access to the S3 bucket, you should define an IAM role for the Lambda function that includes the necessary S3 read permissions. AWS SAM provides pre-defined policy templates, including S3ReadPolicy, which grants read-only access to S3. This is the most efficient way to handle permissions within the SAM template.
tullio85 👍 1 Answered D

D is correct. S3 and role is coupled.
Saudis 👍 1 Answered D

ans is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide