You are building a Lambda function that connects to an AWS Aurora cluster and performs SQL queries. You want to use IAM database authentication to connect to the DB cluster so that the Lambda function does not need to use a username and password. IAM should manage the authentication process. How would you implement this?

Answer options:

A.Enable IAM database authentication in the DB cluster and assign the IAM permission to the Lambda execution role.
B.Generate a credential in Secrets Manager and configure the Lambda function to perform database authentication using it.
C.Create an IAM user for the database and enable the IAM database authentication with the user. Assign the user to the Lambda function.
D.Enable IAM database authentication in the Aurora cluster. In the Lambda execution role, add the database as the trusted entity. 

Correct Answer – A
Option A is CORRECT: Because with IAM database authentication, if the Lambda function has the IAM permission, it can receive the authentication token from IAM and connect to the DB.Option B is incorrect: Because Secrets Manager is not suitable as the question mentioned that IAM database authentication should be used.
Option C is incorrect: Because you should attach the IAM policy to the Lambda execution role. You cannot assign an IAM user to the Lambda function.
Option D is incorrect: Because the description is incorrect. After IAM database authentication is enabled, you should add the IAM permission to the role, allowing the Lambda to request an authentication token.
Reference:
https://aws.amazon.com/blogs/database/iam-role-based-authentication-to-amazon-aurora-from-serverless-applications/