A developer is configuring an AWS Lambda function to retrieve messages from an Amazon SQS queue. To follow the security principle of least privilege, the developer decides to create a custom IAM role for the Lambda function. Which of the following configurations are required to establish this access? (Select TWO.)
- An IAM permissions policy attached to the IAM role that allows the `sqs:ReceiveMessage` and `sqs:DeleteMessage` actions on the specific SQS queue ARN.Answer
- An IAM trust policy on the IAM role that allows the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action.Answer
- CHardcoded AWS access keys and secret access keys stored in the Lambda function's environment variables to authenticate SDK client requests.
- DAn IAM trust policy attached directly to the Lambda function resource that allows the SQS service principal to perform the `sts:AssumeRole` action.
- EA trust policy attached directly to the SQS queue that allows the queue to assume the Lambda function's execution role.
Answer
The configurations required are: an IAM permissions policy attached to the IAM role that allows SQS actions on the queue ARN, and an IAM trust policy on the IAM role that allows the Lambda service principal to assume the role.
The correct options specify the two key components of an IAM execution role. First, the trust policy (trust relationship) is configured on the IAM role to allow the AWS Lambda service principal (lambda.amazonaws.com) to assume the role. Second, a permissions policy is attached to the IAM role to grant the permissions necessary for the function's code to run, which in this case includes actions such as reading and deleting messages from the specific SQS queue resource.
Step-by-Step Solution
Key Concept
IAM Roles, Permissions Policies, and Trust Policies
Estimated Time:1m 30s