A developer is using AWS SAM to build a serverless application. The application defines a Lambda function that needs to consume messages from an Amazon SQS queue. The developer is writing the `template.yaml` file and wants to ensure that the template is parsed correctly as an AWS SAM template and that the Lambda function is granted only the minimum necessary permissions to poll the queue. Which of the following actions should the developer take in the `template.yaml` file to meet these requirements? (Select TWO).
- Include `Transform: AWS::Serverless-2016-10-31` at the root level of the template file.Answer
- Add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.Answer
- CDefine a custom IAM trust policy within the function properties that explicitly allows the `sqs.amazonaws.com` service principal to assume the function's execution role.
- DAdd the declaration `AWS::Serverless-2016-10-31` under the `Globals` section of the template.
- EConfigure the function's environment variables to retrieve the SQS queue URL dynamically from AWS Secrets Manager using a dynamic reference.
Answer
The correct actions are to include the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file and to add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.
To successfully deploy an AWS SAM application, the template must include the `Transform` declaration at the root level so that CloudFormation can translate the serverless resources. Additionally, to grant the Lambda function the ability to read from the SQS queue with least privilege, the pre-defined `SQSPollerPolicy` template should be added directly under the function's `Policies` property.
Step-by-Step Solution
Key Concept
AWS SAM template structure requirements and SAM policy templates for IAM permission management.