Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

SCS-C02 By islever Editorial Last updated

Design, implement, and troubleshoot authorization for AWS resources. Evaluate the compliance of AWS resources.

Short answer

B Attach AWSSecurityHubReadOnlyAccess; the Lambda reads findings from Security Hub, so Inspector access is unnecessary.

Question

A company wants to automate the creation of a security report. The company has an AWS Lambda function that gathers data from Amazon Inspector findings stored in AWS Security Hub in the us-west-2 Region. The Lambda function then needs to create a daily report by using an Amazon EventBridge schedule. A security engineer discovers that the Lambda function is failing to create the report. The security engineer must implement a solution that corrects the issue and provides least privilege permissions. Which solution will meet these requirements?
  1. Create a resource-based policy that allows Security Hub access to the ARN of the Lambda function.
  2. Attach the AWSSecurityHubReadOnlyAccess AWS managed policy to the Lambda function’s execution role. Correct Answer
  3. Grant the Lambda function’s execution role read-only permissions to access Amazon Inspector and Security Hub.
  4. Create a custom IAM policy that grants the Security Hub Get, List, Batch, and Describe permissions on the arn:aws:securityhub:us-west-2::product/aws/inspector/* resource. Attach the policy to the Lambda function’s execution role.

Key Takeaways

The Lambda consumes findings from Security Hub, not by calling Inspector APIs, so Inspector permissions are unnecessary. The least-privilege fix is Security Hub read-only access (AWSSecurityHubReadOnlyAccess). Granting Inspector read as well (option C) or a broad custom Batch* policy (option D) exceeds what the function needs.

A Lambda builds a daily report from Amazon Inspector findings that are stored in AWS Security Hub. Because the data already resides in Security Hub, the function only needs permission to read Security Hub findings—not Amazon Inspector directly. Attaching the AWS managed AWSSecurityHubReadOnlyAccess policy to the execution role gives exactly the read access required with least privilege, fixing the failure without over-granting.

Common mistake: Granting both Inspector and Security Hub read access (option C) on the assumption the function needs Inspector—it reads findings from Security Hub, so Inspector access is surplus. Or a custom policy with Batch* actions (option D), which is broader than read-only and riskier.

Expert Analysis

Why the Answer Is Correct

The Lambda gathers Inspector findings that are already aggregated in Security Hub, so it needs only Security Hub read permissions. Attaching AWSSecurityHubReadOnlyAccess to the execution role provides precisely that, adhering to least privilege and resolving the access failure without granting Inspector or write capabilities.

Why the Other Options Are Wrong

A (resource-based policy allowing Security Hub to invoke Lambda) addresses invocation, not the data-read permission the function lacks. C grants read to both Inspector and Security Hub, exceeding least privilege since the data is in Security Hub. D uses a custom policy with Batch* permissions, which is broader than read-only and less aligned with least privilege than the managed read-only policy.

Community Comment Notes

Community split B (43) vs C (43). The least-privilege argument favors B: findings are already in Security Hub, so only SH read is needed; C over-grants Inspector. A commenter noted D's Batch* is a problem and B's managed policy is read-only. B is the minimal, correct grant.

Official Reference

https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-access.html

This link opens the official vendor documentation in a new tab.

Community Votes

B
50%
C
50%

50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. HappyG 👍 3 Answered C
    C grants the Lambda function's execution role the necessary permissions to read from both Amazon Inspector and AWS Security Hub, but not granting excessive permissions. This approach adheres to the principle of least privilege by providing only the necessary permissions for the Lambda function to perform its task.
  2. Pmktechno 👍 3 Answered C
    This approach ensures that the Lambda function has the necessary permissions to read data from Amazon Inspector and Security Hub without granting excessive permissions. It aligns with the principle of least privilege by only allowing the specific actions required for the Lambda function to perform its task.
  3. 8acf42c 👍 3 Answered C
    By explicitly granting read-only permissions to both Amazon Inspector and Security Hub, the Lambda function will have the least privilege access it needs to retrieve findings and generate the report. This aligns with best practices.
  4. 723993f 👍 3 Answered D
    is it not D ? or is the Batch:* a problem ? but i think there are no batch write/delete operations that can be performed on that resource arn anyways
  5. jdx000 👍 3 Answered B
    the findings are already in security hub, so only read access to security hub is needed
Show 5 more comments
  1. Asma2023 👍 2 Answered B
    beacause findings are already stored in AWS Security HUB
  2. SCSC02Q 👍 1 Answered B
    its B, since the Batch on D is a problem, enabling more the read access. In comparison, B provides only BatchGet so ok.
  3. TareDHakim 👍 1 Answered B
    B, there's no need for permissions to Inspector as logs already populated in Security Hub.
  4. SCSC02Q 👍 1 Answered B
    * enabling more than read access...
  5. Palanda 👍 1 Answered B
    I agree with b

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

Immediately contain a running EC2 by associating a Deny-all NACL with its (sole-occupant) subnet

S-grade

← Back to SCS-C02 Study Guide