Question 700
A Lambda function is invoked over an AWS-managed runtime and exposes an overly broad IAM role. What AWS principle BEST explains this situation?
Explanation
Correct Answer
AWS manages execution infrastructure while customers grant what their workloads can access. This principle explains why the suitable decision is: Narrow the function's execution-role permissions as a customer control. The confirming observation would be: The function succeeds on approved operations and is denied unrelated service actions. A useful continuing practice is: Review permissions with each function release.
Incorrect Answers
AWS protects the underlying cloud infrastructure but customers administer EC2 guest operating systems. In this question, however, aWS manages execution infrastructure while customers grant what their workloads can access. The answer that meets the requirement is: AWS manages execution infrastructure while customers grant what their workloads can access.
The provider operates physical cloud infrastructure that customers do not directly manage. In this question, however, aWS manages execution infrastructure while customers grant what their workloads can access. The answer that meets the requirement is: AWS manages execution infrastructure while customers grant what their workloads can access.
Serverless execution management does not transfer customer application correctness or authorized access policy to AWS. In this question, however, aWS manages execution infrastructure while customers grant what their workloads can access. The answer that meets the requirement is: AWS manages execution infrastructure while customers grant what their workloads can access.