A permit portal AWS Lambda function must read and write items in DynamoDB in the same account without embedding access keys. What should the architect attach?
Select an answer to reveal the explanation.
Short Explanation
Lambda already has a backpack for credentials—the execution role. Fill it with only the DynamoDB actions the permit portal needs, and skip stuffing access keys into env vars. Temporary creds flow in automatically; least privilege keeps the blast radius small.
Full Explanation
Lambda functions authenticate to AWS services using an execution role. The role’s policy should grant only the DynamoDB APIs and resources the permit portal requires. Embedding IAM user or root access keys in environment variables or layers introduces durable secrets and bypasses the recommended temporary-credential model. Mapping citizen Cognito identities to AdministratorAccess is unrelated to least-privilege service-to-service access.