SAA-C03 Q437 · Security

Question

An application uses an Amazon SQS queue and two AWS Lambda functions. One of the Lambda functions pushes messages to the queue, and the other function polls the queue and receives queued messages. A solutions architect needs to ensure that only the two Lambda functions can write to or read from the queue. Which solution will meet these requirements?

Accepted Answer

**Answer C** uses a two-layer authorization approach that correctly satisfies both requirements:

1. **Resource-based policy on the SQS queue**: Grants the two Lambda function principals read and write access. This tells the SQS queue 'these two Lambda functions are allowed to interact with me.' This acts as the queue-side permission gate.

2. **IAM policy on each Lambda execution role**: Grants read and write access to the queue. This tells each Lambda function 'you are allowed to interact with this SQS queue.' This acts as the caller-side permission gate.

**Why this meets 'only these two functions' requirement**: The resource-based policy on the SQS queue only lists the two Lambda function principals. No other entity has been granted access through the queue's resource policy. Combined

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

🔒 Security

🎯 Exam Tips