Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

An AWS Lambda function in Account A (111122223333111122223333) is configured to download files from an Amazon S3 bucket located in Account B (444455556666444455556666). The S3 bucket is encrypted using an AWS KMS customer managed key also located in Account B. The Lambda function's IAM execution role in Account A has an identity-based policy that grants permission for the `s3:GetObject` and `kms:Decrypt` actions. When the Lambda function runs, it fails to retrieve objects and receives an Access Denied error. Which two actions must be taken in Account B to resolve this authorization failure?

  1. Modify the Amazon S3 bucket policy in Account B to grant the `s3:GetObject` permission to the Lambda execution role in Account A.Answer
  2. Modify the AWS KMS key policy in Account B to grant the `kms:Decrypt` permission to the Lambda execution role in Account A.Answer
  3. C
    Update the trust policy of the Lambda execution role in Account A to trust the `kms.amazonaws.com` service principal.
  4. D
    Configure the Lambda function to use an Amazon Cognito Identity Pool to retrieve temporary credentials to access the AWS KMS key.
  5. E
    Hardcode temporary access credentials generated from Account B directly in the Lambda function's initialization code.

Answer

To resolve the authorization failure, the S3 bucket policy in Account B must be updated to grant the Lambda execution role `s3:GetObject` permissions, and the KMS key policy in Account B must be updated to grant the Lambda execution role `kms:Decrypt` permissions.
For cross-account resource access where KMS encryption is involved, the target resource policies must grant access. Specifically, the S3 bucket policy in Account B must permit `s3:GetObject` to the Lambda execution role in Account A. Additionally, because the S3 object is encrypted with a customer managed KMS key in Account B, the KMS key policy in Account B must explicitly permit the `kms:Decrypt` action for the external Lambda role. Local IAM policies in Account A cannot grant access to external KMS keys without the key policy delegating that permission.

Step-by-Step Solution

1
Examine the S3 cross-account access requirements.
For cross-account access to Amazon S3, both the identity-based policy in the source account (Account A) and the resource-based bucket policy in the destination account (Account B) must explicitly allow the operation.
Since the resource is in a different account, AWS evaluates both policies to determine authorization.
2
Examine the KMS cross-account access requirements.
For cross-account access to a customer managed KMS key, the KMS key policy in the owning account (Account B) must explicitly grant permission to the external account or IAM principal.
Unlike same-account KMS access where the key policy can delegate authorization to IAM policies, cross-account access requires explicit permission in the key policy itself.

Key Concept

Cross-account authorization requires resource-based policies (S3 bucket policy and KMS key policy) in the target account to explicitly trust and grant permissions to the IAM identity in the source account.
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic