Question

A development team deploys a serverless function in a public cloud that reads objects from a single storage bucket and writes results to a message queue. During a security review, you discover the function is assigned an execution role with full administrative permissions to all cloud services. Following cloud application and workload security best practices, what is the MOST appropriate remediation?

Accepted Answer

Scope the function's execution role to only the specific storage read and message queue write permissions it requires, applying least privilege

Answer

Leave the administrative role in place but enable multi-factor authentication on the developer accounts that deploy the function

Answer

Move the function behind a web application firewall to inspect incoming requests before they reach the code

Answer

Encrypt the storage bucket and message queue with a customer-managed key to prevent unauthorized data access