A developer is creating an IAM role for an AWS Lambda function that needs to write logs to an Amazon S3 bucket named "my-app-logs-bucket". The developer has written the following permissions policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-app-logs-bucket/*"
}
]
}
Which two configuration steps must the developer perform to ensure the Lambda function has the necessary permissions to write to the S3 bucket?
- Configure the trust policy of the IAM role to allow the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
- Attach the S3 permissions policy to the IAM role that is associated with the Lambda function.Answer
- CConfigure the trust policy of the IAM role to allow the s3.amazonaws.com service principal to perform the sts:AssumeRole action.
- DEmbed the IAM user access key and secret access key directly in the Lambda function code to authorize the S3 client.
- EDefine the s3:PutObject action inside the principal block of the trust policy document.
Answer
Configure the trust policy of the IAM role to allow the lambda.amazonaws.com service principal to perform the sts:AssumeRole action, and attach the permissions policy to the IAM role associated with the Lambda function.
To allow an AWS Lambda function to access S3 resources using an IAM role, two components are required: a permissions policy attached to the role that allows the s3:PutObject action, and a trust policy configured on the role that allows the Lambda service (lambda.amazonaws.com) to assume the role (sts:AssumeRole).
Step-by-Step Solution
Key Concept
IAM execution roles require both a trust policy allowing the service to assume the role and permissions policies granting access to destination resources.