A Lambda function reads metadata from an S3 object and stores the metadata in a DynamoDB table. The function is triggered whenever an object is stored within the S3 bucket.
How should the Lambda function be given access to the DynamoDB table?
 

Answer options:

A.Create a VPC endpoint for DynamoDB within a VPC. Configure the Lambda function to access resources in the VPC.B.Create a resource policy that grants the Lambda function permissions to write to the DynamoDB table. Attach the policy to the DynamoDB table.
C.Create an IAM user with permissions to write to the DynamoDB table. Store an access key for that user in the Lambda environment variables.
D.Create an IAM service role with permissions to write to the DynamoDB table. Associate that role with the Lambda function.

Answer is D
Option A is incorrect because you only use this option when you are trying to access DynamoDB from a VPC.Option B is incorrect because you need to attach an lAM policy and not a service policy.
Option C is incorrect because using IAM users and access keys is a bad practice for giving access to applications.
Option D is CORRECT because the ideal way is to create an IAM role that has the required permissions and then associate it with the Lambda function. The IAM role will have all the necessary permissions for secure access to AWS resources.
The AWS Documentation additionally mentions the following:
Each Lambda function has an IAM role (execution role) associated with it. You specify the IAM role when you create your Lambda function. Permissions you grant to this role determine what AWS Lambda can do when it assumes the role.
For more information on the Lambda permission model, please visit the below URL https://docs.aws.amazon.com/lambda/latest/dg/lambda-permissions.html.