Examkin

Question

Difficulty: HardDebugging Lambda Execution and Configuration Issues

A developer is deploying a backend worker microservice as an AWS Lambda function. The function is designed to poll an Amazon SQS queue, process incoming JSON messages, and write results to an Amazon DynamoDB table. The developer creates an IAM role named BackendWorkerRole and attaches the managed policies AWSLambdaSQSQueueExecutionRole and AmazonDynamoDBFullAccess to it. However, when trying to associate BackendWorkerRole as the execution role in the Lambda function's configuration using the AWS CLI, the command fails with the following error:

An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda.

Which of the following configuration adjustments is required to resolve this error?

  1. A
    Add an inline permission policy to the role that explicitly grants the sts:AssumeRole action on the AWS Lambda service principal.
  2. Modify the trust policy of the role to specify 'lambda.amazonaws.com' as the trusted service principal allowed to assume the role.Answer
  3. C
    Update the Lambda function's initialization code to explicitly call the AWS STS AssumeRole API using hardcoded temporary access keys.
  4. D
    Increase the Lambda function's execution timeout limit to 15 minutes to ensure that the STS session credentials do not expire during function creation.

Answer

Modify the trust policy of the role to specify 'lambda.amazonaws.com' as the trusted service principal allowed to assume the role.
The correct answer is correct because AWS Lambda requires a trust policy (trust relationship) defined on the execution role. This policy must explicitly trust the 'lambda.amazonaws.com' service principal and allow it to perform the 'sts:AssumeRole' action. Without this trust configuration, AWS Lambda cannot assume the execution role to retrieve the credentials needed to access downstream resources.

Step-by-Step Solution

1
Analyze the error message returned by the AWS CLI execution.
The error indicates that Lambda is blocked from assuming the defined execution role.
The AWS Lambda service principal must have trust relationship permissions to assume the role on the user's behalf.
2
Review the trust policy of the BackendWorkerRole IAM role.
Identify that the trust policy is missing the service principal lambda.amazonaws.com or restricts it incorrectly.
Trust policies govern which entities can assume the role, whereas permission policies govern what the role can access.
3
Update the IAM role's trust relationship document to allow lambda.amazonaws.com.
The Lambda service can now successfully assume the role using AWS STS, and the function configuration succeeds.
This updates the trust configuration necessary for AWS Lambda to execute in your account environment.

Key Concept

IAM Execution Role Trust Policies for AWS Lambda
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic