Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer is configuring a serverless application where an AWS Lambda function in AWS Account A (111111111111111111111111) needs to read objects from an Amazon S3 bucket named `company-data-shared` in AWS Account B (222222222222222222222222). The Lambda function is associated with the execution role `arn:aws:iam::111111111111:role/LambdaExecutionRole`. Currently, the Lambda function fails with an `AccessDenied` error when attempting to fetch objects from the bucket. Which configuration changes must the developer make to resolve the error while maintaining the principle of least privilege? (Select two.)

  1. In Account A, attach a permission policy to the Lambda execution role that grants the `s3:GetObject` action on `arn:aws:s3:::company-data-shared/*`.Answer
  2. In Account B, update the bucket policy of `company-data-shared` to allow the `s3:GetObject` action on `arn:aws:s3:::company-data-shared/*` for the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole`.Answer
  3. C
    In Account B, configure a trust policy on the S3 bucket that allows the Lambda execution role in Account A to perform `sts:AssumeRole` on the bucket.
  4. D
    Modify the Lambda function code to use hardcoded IAM access keys and secret keys of a user in Account B that has read permissions to the S3 bucket.
  5. E
    In Account A, update the trust policy of the Lambda execution role to allow the Amazon S3 service principal `s3.amazonaws.com` to assume the role.

Answer

In Account A, attach a permission policy to the Lambda execution role that grants the s3:GetObject action on the S3 bucket, and in Account B, update the bucket policy of the S3 bucket to allow s3:GetObject for the Lambda execution role principal.
For cross-account S3 access, permissions must be granted on both sides. The identity-based policy attached to the Lambda execution role in Account A must grant the `s3:GetObject` permission on the specific bucket resource in Account B. Simultaneously, the resource-based bucket policy on the S3 bucket in Account B must grant the same permission to the Lambda execution role's ARN as the principal. Without both configurations, cross-account access will be denied.

Step-by-Step Solution

1
Configure the IAM identity-based policy in Account A.
The Lambda execution role in Account A is granted permission to perform `s3:GetObject` on the S3 bucket in Account B.
Even for cross-account resources, the requesting identity must explicitly have the permission granted in its own account's policy.
2
Configure the S3 bucket policy (resource-based policy) in Account B.
The S3 bucket permits the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` from Account A to read objects.
For cross-account access, both the identity-based policy in the source account and the resource-based policy in the destination account must explicitly allow the action.
3
Verify the configuration using the Lambda function's execution context without using hardcoded credentials.
The Lambda function uses its execution role's temporary credentials automatically provided by the AWS SDK, resolving the access issue securely.
Hardcoding credentials violates security best practices and is unnecessary because the SDK automatically uses the IAM role credentials.

Key Concept

Cross-account resource access in AWS requires authorization from both the identity-based policy (source account) and the resource-based policy (destination account).
Rate this question

Topics

IAM Policies and Roles

More questions from this topic