How to configure S3 read access in AWS SAM?

A developer is automating a new application deployment with AWS Serverless Application Model (AWS SAM). The new application has one AWS Lambda function and one Amazon S3 bucket. The Lambda function must access the S3 bucket to only read objects. How should the developer configure AWS SAM to grant the necessary read privilege to the S3 bucket?

  1. Reference a second Lambda authorizer function.
  2. Add a custom S3 bucket policy to the Lambda function.
  3. Create an Amazon Simple Queue Service (SQS) topic for only S3 object reads. Reference the topic in the template.
  4. Add the S3ReadPolicy template to the Lambda function's execution role. Source Reference Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests knowledge of AWS SAM policy templates versus manual IAM configuration, with the trap being the confusion between resource-based policies (bucket policies) and identity-based policies (execution roles).

To grant a Lambda function read access to an S3 bucket using AWS SAM, developers should utilize the framework's built-in policy templates. The community consensus confirms that attaching the S3ReadPolicy to the function's execution role is the standard and most efficient method.

Choosing to add a custom S3 bucket policy (Option B) is a common mistake because, while it can restrict access, AWS SAM is designed to simplify permission management by attaching managed policies directly to the Lambda execution role.

Community Discussion (3 comments)

tullio85 👍 1 Selected: D
D is correct. S3 and role is coupled.
examuserss 👍 1 Selected: D
The correct answer is D. AWS SAM simplifies infrastructure-as-code deployments. To grant the Lambda function read access to the S3 bucket, you should define an IAM role for the Lambda function that includes the necessary S3 read permissions. AWS SAM provides pre-defined policy templates, including S3ReadPolicy, which grants read-only access to S3. This is the most efficient way to handle permissions within the SAM template.
Saudis 👍 1 Selected: D
ans is D

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Option D is correct because AWS SAM provides pre-defined policy templates, such as S3ReadPolicy, which automatically generate the necessary IAM permissions for a Lambda execution role. This method adheres to the principle of least privilege by granting only read access (specifically s3:Get*) to the specified S3 bucket. It simplifies the infrastructure code significantly compared to writing raw IAM policy documents from scratch.

Why the Other Options Are Wrong

Option A is incorrect because Lambda authorizers are used for controlling access to API Gateway endpoints, not for granting S3 object permissions. Option B is incorrect or less optimal because while bucket policies are valid for S3 access control, SAM specifically streamlines permission management via the execution role's Policies property. Option C is incorrect because Amazon SQS is a messaging service and does not serve as a mechanism to grant S3 read permissions to a Lambda function.

Community Comment Notes

Community comments strongly support Option D, emphasizing that AWS SAM simplifies infrastructure-as-code deployments by offering these pre-defined templates. Users noted that coupling the S3 permissions directly with the Lambda role is the intended design pattern in SAM, avoiding the complexity of custom bucket policies.

Official Reference

Exam Strategy

When you see 'AWS SAM' and 'permissions' in a question, always look for options involving SAM-specific policy templates or the Policies property in the function definition. Avoid manual bucket policies or unrelated services like SQS unless the scenario specifically requires cross-account access not covered by standard templates.

Related Analysis

A developer is publishing critical log data to a log group i

A-Grade

A company's developer has deployed an application in AWS by

S-Grade

A developer is working on an app for a company that uses an

A-Grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide