Examkin

Question

Difficulty: EasyIAM Policies and Roles

A developer is configuring an AWS Lambda function that needs to retrieve files from an Amazon S3 bucket. Which two IAM configurations are required to allow the Lambda function to assume its execution role and read the objects from the bucket? (Select TWO.)

  1. A trust policy on the IAM role that grants the "sts:AssumeRole" action to the "lambda.amazonaws.com" service principal.Answer
  2. An IAM permissions policy attached to the IAM role that grants the "s3:GetObject" action on the target S3 bucket resource.Answer
  3. C
    A trust policy on the IAM role that grants the "sts:AssumeRole" action to the "s3.amazonaws.com" service principal.
  4. D
    Hardcoded IAM user credentials embedded within the Lambda function code to initialize the S3 SDK client.
  5. E
    An IAM permissions policy attached to the IAM role that allows the "sts:AssumeRole" action on the S3 bucket resource.

Answer

The correct configurations are: a trust policy on the IAM role that grants the "sts:AssumeRole" action to the Lambda service principal, and an IAM permissions policy attached to the IAM role that grants the "s3:GetObject" action on the target S3 bucket.
The correct options state that a trust policy must grant the "sts:AssumeRole" action to the Lambda service principal, and that a permissions policy must grant the "s3:GetObject" action on the target S3 bucket. Together, these allow the Lambda service to assume the execution role and grant that role the specific permissions needed to retrieve S3 objects.

Step-by-Step Solution

1
Identify the AWS service principal executing the function code.
The service principal is "lambda.amazonaws.com".
This principal must be permitted to assume the execution role via the trust policy.
2
Determine the necessary data access actions and resource boundaries.
The action is "s3:GetObject" and the resource is the specific Amazon S3 bucket ARN.
A permissions policy must be created to grant the role read access to the S3 bucket.
3
Attach both policies to the Lambda execution role.
The trust policy establishes trust with AWS Lambda, and the permissions policy grants S3 read access to the role.
Both policies must be present for the Lambda function to safely execute and access the S3 objects under the security envelope of the role.

Key Concept

IAM execution roles require a trust policy to define the assuming principal (who) and permissions policies to define the allowed actions and resources (what).
Estimated Time:1m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic