Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an AWS Step Functions state machine to orchestrate a serverless workflow. The state machine needs to invoke an AWS Lambda function and publish execution status updates to an Amazon SNS topic. During testing, the state machine execution fails with an IAM authorization error. Which of the following configurations are required to resolve this issue and grant the state machine the necessary permissions? (Select TWO.)

  1. Attach an IAM role to the Step Functions state machine with a trust policy that allows the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action.Answer
  2. Attach a permissions policy to the Step Functions execution role that allows the `lambda:InvokeFunction` action on the Lambda function's ARN and the `sns:Publish` action on the SNS topic's ARN.Answer
  3. C
    Configure the Step Functions execution role's trust policy to trust the `lambda.amazonaws.com` and `sns.amazonaws.com` service principals.
  4. D
    Attach an IAM role to the Lambda function and the SNS topic, and configure their trust policies to allow the `states.amazonaws.com` service principal to assume them.
  5. E
    Embed temporary AWS access credentials inside the Step Functions state machine definition parameters to authenticate the Lambda and SNS API requests.

Answer

To resolve the authorization issue, you must configure a trust policy on the Step Functions execution role allowing the `states.amazonaws.com` service principal to perform `sts:AssumeRole`, and attach a permissions policy to that execution role that allows the `lambda:InvokeFunction` and `sns:Publish` actions on the target resource ARNs.
AWS Step Functions must assume an IAM role to perform tasks like invoking Lambda functions or publishing messages to SNS. For the service to assume this role, the trust policy must explicitly allow the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action. Additionally, the role itself must be granted permissions via an attached permissions policy to perform `lambda:InvokeFunction` and `sns:Publish` on the specific resources.

Step-by-Step Solution

1
Determine the executing principal that requires access.
The executing principal is the AWS Step Functions service (`states.amazonaws.com`).
Step Functions requires an IAM execution role to make API calls to other AWS resources on behalf of the user.
2
Establish the trust relationship for the execution role.
Add a trust policy to the role allowing `states.amazonaws.com` to call `sts:AssumeRole`.
Without this trust policy, the Step Functions service cannot assume the role to retrieve temporary security credentials.
3
Define the resource permissions for the execution role.
Attach an identity-based permissions policy granting `lambda:InvokeFunction` and `sns:Publish` on the respective ARNs.
Once the role is assumed, Step Functions must have the explicit authorization to perform the required actions on the target resources.

Key Concept

Configuring IAM execution roles requires establishing a trust policy that permits the calling service principal to assume the role, combined with a permissions policy that grants the role access to perform actions on specific resources.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic