{"question":{"id":12319,"htmlId":"question12319","kind":"SingleChoice","specVersion":null,"questionHtml":"

Your company has an application that uploads processed data to an S3 bucket. You need to design a system where an AWS Lambda function is invoked for each new object created in the bucket to perform additional processing. What combination of steps should be taken to ensure the proper integration between S3 and the Lambda function?

","descriptionHtml":"

To trigger an AWS Lambda function on S3 object creation, an event notification should be configured on the specific S3 bucket. Each event notification can specify an event type (such as 's3:ObjectCreated:*') and the destination for the event, which would be the Lambda function's ARN (Amazon Resource Name). Thus, the correct answer is 'Configure an event notification on the S3 bucket to invoke the Lambda function when an object is created'. Bucket policies and CORS configurations on the S3 bucket do not relate to the invocation of Lambda functions based on object creation events. An S3 lifecycle policy is used for object management (such as expiration or transition) and not for event invocation of Lambda functions

","answers":[{"id":2438685,"html":"

Apply a bucket policy to the S3 bucket to allow the Lambda function to be invoked when a new object is created.

","isCorrect":false},{"id":2438688,"html":"

Create an S3 lifecycle policy that invokes the Lambda function upon new object upload.

","isCorrect":false},{"id":2438687,"html":"

Enable Cross-Origin Resource Sharing (CORS) on the S3 bucket to trigger the Lambda function.

","isCorrect":false},{"id":2438686,"html":"

Configure an event notification on the S3 bucket to invoke the Lambda function when an object is created.

","isCorrect":true}],"textInput":null,"matching":null,"objectiveId":1732,"objectiveTitle":"Development with AWS Services","nextQuestionUrl":"/study/questions/dva-c02/a-financial-services-company-needs-a-secure-way-to-manage-the-lifecycle-of/12391?HideScore=false&ObjectiveMode=RoundRobbinObjectives","questionUrl":"/study/questions/dva-c02/your-company-has-an-application-that-uploads-processed-data-to-an-s3/12319","followUpPrompts":[{"id":340731,"prompt":"How do I trigger a Lambda when a new S3 object is created?","response":"Configure an S3 event notification on the bucket to invoke the Lambda function when an object is created. Set the event type (for example s3:ObjectCreated:*) and the Lambda function ARN as the destination. You can create the notification in the S3 console, via the AWS CLI, SDKs, or CloudFormation. When you wire S3 -> Lambda you must also ensure Lambda's resource-based policy allows S3 to invoke it (the console often adds this automatically; when using IaC or CLI you may need to call lambda:AddPermission with principal s3.amazonaws.com and the source ARN). Use prefix/suffix filters on the notification to limit which object keys trigger the function. Bucket policies control access, CORS controls browser cross-origin requests, and lifecycle rules manage object transitions/expiration — none of those trigger Lambda invocations. Follow-up questions: 1) How do I grant S3 permission to invoke my Lambda? — Use lambda:AddPermission to add a resource-based policy statement granting principal "s3.amazonaws.com" permission to call "lambda:InvokeFunction" on your function. Include the SourceArn (the bucket ARN) or SourceAccount to scope the permission. If you configure the notification in the S3 console, AWS will add the permission for you automatically. When using CloudFormation, use AWS::Lambda::Permission referencing the bucket ARN. 2) What S3 event types and filters can I use? — Common event types include s3:ObjectCreated:* (covers Put, Post, Copy, CompleteMultipartUpload), s3:ObjectRemoved:* (Delete events), and more (Replication, Restore). You can add a filter by key prefix and/or suffix so only objects with matching names trigger the Lambda (for example prefix "uploads/" and suffix ".csv"). Filters reduce unnecessary invocations and cost. 3) Why don't bucket policies, CORS, or lifecycle rules invoke Lambda? — Bucket policies define who can access the bucket (permissions), CORS allows browser-based cross-origin requests, and lifecycle rules manage storage class transitions and expirations. None are event mechanisms for notifications. S3 event notifications (or S3 Object Lambda for on-read transformations) are the features designed to send events to Lambda, SNS, or SQS when object-level changes occur."},{"id":340732,"prompt":"How do I configure an S3 event notification to invoke a Lambda function (with filters)?","response":"Configure an S3 event notification either in the S3 console, CLI, or IaC (CloudFormation/Terraform): - Console: S3 bucket → Properties → Event notifications → Create notification. Choose event type (e.g., s3:ObjectCreated:*), set destination to your Lambda function, and optionally add key filters (prefix/suffix) so only matching object keys trigger the function. The console usually adds the required invocation permission to the Lambda automatically. - CLI/API: Use aws s3api put-bucket-notification-configuration with a NotificationConfiguration that includes LambdaConfigurations (LambdaFunctionArn and Events) and optional Filter rules. - CloudFormation: Add NotificationConfiguration on AWS::S3::Bucket with LambdaConfigurations, and add an AWS::Lambda::Permission resource allowing s3.amazonaws.com to InvokeFunction (include SourceArn condition pointing to the bucket). Notes: Use event type s3:ObjectCreated:* for all create events. Filters reduce invocations and cost. When configuring via API/IaC, you must explicitly add the Lambda permission so S3 can invoke it."},{"id":340733,"prompt":"What permissions or policies are required so S3 can invoke my Lambda and the function can read the object?","response":"Two permission sets are required: 1) Permission for S3 to invoke the Lambda (resource-based on the Lambda): - Lambda must have a resource-based permission that allows the principal s3.amazonaws.com to perform lambda:InvokeFunction. This is commonly added with AWS CLI/SDK via lambda:AddPermission or via CloudFormation (AWS::Lambda::Permission) with Principal = "s3.amazonaws.com" and SourceArn = the bucket ARN. For extra safety add a SourceAccount condition to restrict cross-account invocation. 2) Permissions for the Lambda execution role (IAM role attached to the function): - If the function reads the uploaded object, its execution role needs s3:GetObject (and s3:ListBucket if listing) on the bucket/key prefix. If objects are encrypted with SSE-KMS, add kms:Decrypt on the KMS key. Grant least privilege scoped to the specific bucket/prefix. Note: S3 bucket policies or CORS do not grant invocation rights to Lambda; the Lambda resource permission is required. The console often automates adding the invocation permission when you create the notification."}],"presentationMode":false,"hideFeedbackForm":false,"hideResponseBadges":false,"setId":null,"skipSaveResponse":false},"canVote":false,"streak":{"value":null,"title":null,"launchConfetti":false,"isRecord":false},"id":"crucial-react-0494626a06f142c797661ea995579d4f"}

AWS Certified Developer Associate DVA-C02 Practice Question

Report Issue