Serverless Security: IAM Roles u0026 Least Privilege Quiz Quiz

Deepen your understanding of serverless security by assessing your knowledge of IAM roles, permissions, and least privilege principles. This quiz challenges your grasp on access controls and best practices for minimizing risk in serverless deployments.

1. Understanding Least Privilege

   Which approach best demonstrates the principle of least privilege for a serverless function that only needs to read data from a database?

   1. Grant read-only access to the specific database resource
   2. Deny all permissions except write to the database
   3. Assign full database admin permissions to the function
   4. Allow all actions on the entire account resources

   Explanation: Granting read-only access to the specific database resource ensures the function has just enough permission to carry out its job, which aligns with the least privilege principle. Assigning full database admin permissions or allowing all actions gives excessive access, increasing risk. Denying all except write would block reading, which the function needs.

2. IAM Role Misconfiguration Risk

   What potential security risk arises when a serverless function is assigned an IAM role with permissions that are too broad, such as 'Resource: *' and 'Action: *'?

   1. Unauthorized actions can be performed if the function is exploited
   2. Serverless deployment will fail
   3. The function will run slower due to permission checks
   4. Logging will be disabled for the function

   Explanation: Overly broad permissions can allow an attacker to perform a variety of unauthorized actions if the function is compromised. A too-broad IAM role does not cause the deployment to fail or slow function execution, and permissions do not inherently affect logging. Only the first option addresses the critical risk posed by excessive privileges.

3. Role Assignment Best Practice

   When configuring IAM roles for multiple serverless functions that perform unrelated tasks, what is the recommended best practice?

   1. Assign all functions a read-only role for every resource
   2. Assign each function a unique, task-specific IAM role
   3. Use one global IAM role for all functions
   4. Allow anonymous access to simplify permissions

   Explanation: Assigning unique, task-specific roles ensures each function only has the permissions needed for its job, reducing unnecessary risk. Using a global role exposes every function to permissions it does not need. Granting all functions read-only access to all resources still violates least privilege. Allowing anonymous access is never a secure choice.

4. Granularity of IAM Policies

   What is the most secure way to grant a serverless function access to only a subset of items within a database table?

   1. Grant full table access regardless of function needs
   2. Allow access based on the function’s name only
   3. Use a policy that restricts actions to specific database items
   4. Assign no permissions and let the function fail if it needs access

   Explanation: Restricting actions to specific database items allows for precise control and limiting unnecessary access, adhering to least privilege. Giving full table access is excessive and less secure. Assigning no permissions will break functionality, while using the function’s name for access does not ensure proper authorization.

5. Temporary Credentials Advantage

   Why are temporary credentials considered safer than long-lived credentials for IAM roles assigned to serverless functions?

   1. They reduce the risk of credential leakage if the function is compromised
   2. They make the function run faster
   3. They increase the duration that access is granted
   4. They require less configuration for each function

   Explanation: Temporary credentials expire after a short time, limiting the exposure if credentials are leaked or stolen, making them safer. They do not make the function run faster or require less configuration, and they actually reduce—not increase—the duration of access, which is desirable from a security perspective.