Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer is configuring a custom IAM role named `ApplicationLogWriterRole` for a new AWS Lambda function that must write logs to an Amazon S3 bucket. The developer attempts to define both the trust relationship and the S3 permissions in a single policy document when creating the role. The developer applies the following JSON document as the role's trust policy (Assume Role Policy):

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": [
"sts:AssumeRole",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::app-logs-2026/*"
}
]
}

No other policies are attached to the IAM role. When the Lambda function executes and attempts to upload a log file to the S3 bucket, it receives an `AccessDenied` error. How should the developer resolve this issue?

  1. A
    Update the trust policy's Resource element to "*" and remove the "sts:AssumeRole" action since the role is already associated with the Lambda function.
  2. Modify the trust policy to only allow the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket.Answer
  3. C
    Add a resource-based policy to the S3 bucket that permits "sts:AssumeRole" for the Lambda service principal, and remove the trust policy from the IAM role.
  4. D
    Embed the AWS access key ID and secret access key for an IAM user with S3 write permissions directly in the Lambda function's code to bypass the IAM role.

Answer

Modify the trust policy to only allow the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket.
The correct action is to modify the trust policy to allow only the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket. An IAM role trust policy governs which principal is allowed to assume the role. It cannot be used to grant permissions to access other AWS resources. To grant resource access, the permissions must be attached to the role via an identity-based permission policy.

Step-by-Step Solution

1
Isolate the role's trust relationship from the permissions.
Identify that the trust policy (Assume Role Policy) defines who can assume the role, whereas identity-based policies define what the assumed role can do.
IAM roles use two distinct types of policies: trust policies and permission policies. Combining resource access actions with assume role actions in the trust policy is invalid.
2
Correct the trust policy JSON.
Change the trust policy's Action to only allow "sts:AssumeRole", and set the Resource to "*" (as is standard for trust policies since the target is the role itself).
This allows the Lambda service principal to assume the identity of the IAM role.
3
Create and attach the identity-based permission policy.
Create a policy granting "s3:PutObject" on "arn:aws:s3:::app-logs-2026/*" and attach it directly to the IAM role.
Once the role is assumed, the temporary security credentials will carry the permissions defined in the attached identity-based policy, enabling the S3 upload.

Key Concept

Separation of Trust Policies and Permission Policies in IAM Roles
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic