Reviewed by Aditya Kumar · Last reviewed 2026-03-24
**Why Lambda security**: Lambda executes your code; compromised function = access to everything the role allows. **IAM**: Assign minimal role—only permissions needed. Avoid wildcards; scope resources (e.g., specific bucket/prefix). Use resource-based policies for cross-account....
This easy-level Cloud/Tools question appears frequently in data engineering interviews at companies like Daniel Wellington. While less common, it tests deeper understanding that distinguishes strong candidates.
Start by clearly defining the core concept being asked about. Interviewers want to see that you understand the fundamentals before diving into implementation details. Structure your answer with a definition, then explain the practical application with a concise example.
Why Lambda security: Lambda executes your code; compromised function = access to everything the role allows. IAM: Assign minimal role—only permissions needed. Avoid wildcards; scope resources (e.g., specific bucket/prefix). Use resource-based policies for cross-account. VPC: Place in private subnets when accessing RDS, ElastiCache, or internal APIs. Use VPC endpoints for S3/DynamoDB to avoid NAT and public internet. VPC adds cold-start latency—only use when necessary. Additional: Encrypt env vars with KMS; never put secrets in plaintext. Set reserved concurrency to prevent runaway cost. Use DLQ for failed async invocations. Enable X-Ray and CloudWatch Logs. Code signing for deployment integrity. Scalability: VPC Lambda needs ENI—high concurrency requires sufficient IPs in subnet. Cost: Reserved concurrency guarantees capacity but can increase cost if underutilized.
Pro-Move: 'We use VPC endpoints for S3 so Lambda in VPC doesn't need NAT—saved $200/month and reduced latency.' Red Flag: Over-permissive IAM (s3: or ) or putting secrets in env vars unencrypted—common and dangerous.
Some links below are affiliate links. If you buy through them we may earn a small commission at no extra cost to you — it helps keep DataEngPrep free.
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.