Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer has configured an AWS Lambda function in Account A (123456789012) to access resources in Account B (987654321098) by assuming an IAM role named CrossAccountAccessRole in Account B. The developer attached an IAM policy to the Lambda execution role in Account A that permits the sts:AssumeRole action. However, when the Lambda function runs and attempts to assume the role, the API call fails with an AccessDenied error.

The trust policy for CrossAccountAccessRole in Account B is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification must the developer make to resolve this error?

  1. Modify the trust policy of CrossAccountAccessRole in Account B to specify the ARN of the Lambda function's execution role from Account A as the principal.Answer
  2. B
    Modify the trust policy of the Lambda function's execution role in Account A to allow the sts:AssumeRole action from the lambda.amazonaws.com service principal.
  3. C
    Initialize the AWS SDK client inside the Lambda function code by passing the AWS access key and secret access key of an IAM user created directly in Account B.
  4. D
    Modify the trust policy of CrossAccountAccessRole in Account B to specify its own role ARN as the principal.

Answer

Modify the trust policy of CrossAccountAccessRole in Account B to specify the ARN of the Lambda function's execution role from Account A as the principal.
The correct action is to modify the trust policy of the role in Account B to trust the ARN of the Lambda execution role in Account A. When a Lambda function runs, it uses its execution role's credentials to call other AWS services. In this case, the SDK call to assume the cross-account role comes from the Lambda execution role, not the Lambda service principal. Therefore, the trust policy of the target role in Account B must list the execution role's ARN as the trusted principal.

Step-by-Step Solution

1
Determine the identity calling the sts:AssumeRole API.
The AWS SDK call within the running Lambda function uses the credentials of the Lambda function's execution role from Account A.
When code runs inside Lambda, it adopts the execution role's permissions, so any outgoing API calls are signed by that role.
2
Analyze the trust policy of the target role in Account B.
The current trust policy only trusts the service principal 'lambda.amazonaws.com'.
This allows the Lambda service itself to assume the role, but not the specific execution role of a function.
3
Update the trust policy in Account B to allow the cross-account assumption.
Change the principal from 'lambda.amazonaws.com' to the ARN of the Lambda execution role from Account A.
This establishes trust between the target role in Account B and the calling role in Account A, resolving the AccessDenied error.

Key Concept

IAM Role Trust Policies vs. Permissions Policies
Rate this question

Topics

IAM Policies and Roles

More questions from this topic