Examkin

Question

Difficulty: EasyIAM Policies and Roles

A developer is creating an IAM role for an AWS Lambda function. The developer configures the permissions policy correctly but receives an authorization error stating that the function cannot assume the role. The developer inspects the role's trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification must the developer make to the trust policy to allow the Lambda function to assume the role?

  1. Change the Service principal in the trust policy from "ec2.amazonaws.com" to "lambda.amazonaws.com".Answer
  2. B
    Attach an IAM permissions policy to the role that grants the "sts:AssumeRole" action.
  3. C
    Configure the AWS SDK client inside the Lambda function using hardcoded IAM user access keys.
  4. D
    Change the Action in the trust policy statement to "sts:AssumeRoleWithWebIdentity".

Answer

Change the Service principal in the trust policy from "ec2.amazonaws.com" to "lambda.amazonaws.com".
The trust policy determines which principals can assume the role. Because the current trust policy specifies the Amazon EC2 service principal ("ec2.amazonaws.com"), only EC2 instances can assume the role. To allow AWS Lambda to assume the role, the principal must be updated to the Lambda service principal ("lambda.amazonaws.com").

Step-by-Step Solution

1
Analyze the error message and the trust policy.
The Lambda function is unable to assume the IAM role because the trust policy only permits the "ec2.amazonaws.com" service principal.
An AWS service cannot assume an IAM role unless it is explicitly trusted in the role's trust relationship document.
2
Identify the correct service principal for AWS Lambda.
The service principal for AWS Lambda is "lambda.amazonaws.com".
Each AWS service that assumes roles has a specific service principal identifier used in IAM trust policies.
3
Update the trust policy with the correct service principal.
Changing "ec2.amazonaws.com" to "lambda.amazonaws.com" allows the Lambda service to assume the execution role.
This establishes the necessary trust relationship, allowing the function to execute with the role's permissions.

Key Concept

IAM trust policies define which principals (users, roles, accounts, or services) are authorized to assume an IAM role.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic