A Lambda function needs read access to an S3 bucket and read/write access to a DynamoDB table. The correct IAM policy already exists. What is the most secure method to grant the function the required access?

Creating an IAM role for the Lambda function and attaching the policy to that role is the most secure and recommended method. This follows the principle of least privilege and role-based access control. The Lambda function assumes this role at invocation, gaining temporary credentials without needing to store long-lived access keys. Attaching the policy directly to the Lambda function is not possible; policies are attached to identities (users, roles, groups), not resources. Creating an IAM user and storing keys as environment variables is less secure because it involves managing long-lived credentials, increasing the risk of compromise. Using the AWS account root user's keys is highly insecure and grants excessive permissions, violating the principle of least privilege.