Question

A developer deploys a Lambda function that must write items to a single DynamoDB table named OrdersTable and publish notifications to one SNS topic. During code review, a security engineer flags the function's execution role, which currently attaches the AWS managed policy AmazonDynamoDBFullAccess and AmazonSNSFullAccess. The team must follow least-privilege best practices without breaking the function. What should the developer do?

Accepted Answer

Create a custom IAM policy that grants only dynamodb:PutItem on the OrdersTable ARN and sns:Publish on the specific topic ARN, and attach it to the execution role in place of the managed policies.

Answer

Keep the managed policies but add an explicit Deny on all other DynamoDB tables and SNS topics using a resource-based policy on the Lambda function.

Answer

Replace the execution role with the AWS account root credentials stored as encrypted environment variables so the function can access only what the code references.

Answer

Attach the ReadOnlyAccess managed policy to the execution role so the function is limited to safe operations while still allowing the required writes.