AWS Certified Solutions Architect - Associate SAA-C03 — Topic 1 Question 640

Question

A company has an application workflow that uses an AWS Lambda function to download and decrypt files from Amazon S3. These files are encrypted using AWS Key Management Service (AWS KMS) keys. A solutions architect needs to design a solution that will ensure the required permissions are set correctly. Which combination of actions accomplish this? (Choose two.)

Accepted Answer

Correct answer: B, E. The correct answer is B, E. Option B: Grant the decrypt permission for the Lambda IAM role in the KMS key's policy Option E: Create a new IAM role with the kms:decrypt permission and attach the execution role to the Lambda function. AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

AWS Certified Solutions Architect - Associate SAA-C03 — Question 640