Examkin

Question

Difficulty: Very hardResolving IAM and Authorization Failures

An AWS Lambda function is configured with an execution role named `LambdaProcessingRole`. The role has the following identity-based permission policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:PutItem",
"sns:Publish"
],
"Resource": "*"
}
]
}

Additionally, the developer has attached an IAM Permissions Boundary named `DeveloperBoundary` to the role. The policy document for the permissions boundary is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:*",
"s3:*"
],
"Resource": "*"
}
]
}

During execution, the Lambda function successfully writes items to the Amazon DynamoDB table, but attempts to publish messages to the Amazon SNS topic fail with an `AccessDeniedException` error.

Which of the following modifications is required to resolve this authorization failure?

  1. A
    Modify the IAM trust policy of the Lambda execution role to allow sns.amazonaws.com to assume the role.
  2. Update the permissions boundary policy (DeveloperBoundary) to include the sns:Publish action.Answer
  3. C
    Hardcode the AWS credentials of an IAM User with AdministratorAccess in the initialization of the SNS client inside the Lambda code.
  4. D
    Configure a Cognito Identity Pool to authenticate the Lambda function and exchange the user tokens for temporary AWS credentials that have SNS publish permissions.

Answer

Update the permissions boundary policy (DeveloperBoundary) to include the sns:Publish action.
For any IAM entity with a permissions boundary, AWS evaluates permissions based on the intersection of the identity-based policy and the boundary policy. Since the permissions boundary policy in this scenario does not allow any SNS actions, the Lambda function's execution role is denied the ability to publish to the SNS topic, even though its identity-based policy allows it. Updating the permissions boundary to allow the sns:Publish action resolves the failure.

Step-by-Step Solution

1
Identify that the Lambda function execution role has both an identity-based policy and a permissions boundary attached.
The identity-based policy allows both DynamoDB and SNS actions, but the permissions boundary only allows DynamoDB and S3 actions.
An IAM permissions boundary limits the maximum permissions that can be granted by identity-based policies to the user or role.
2
Evaluate the intersection of allowed actions between the identity-based policy and the permissions boundary.
The intersection allows dynamodb:PutItem, but does not allow sns:Publish because sns:Publish is missing from the permissions boundary.
For an action to be authorized, it must be allowed by both policies.
3
Determine the necessary change to allow sns:Publish.
Modify the permissions boundary (DeveloperBoundary) to include the sns:Publish action.
This updates the maximum allowed permission threshold, allowing the identity-based permission policy to take effect for SNS publishing.

Key Concept

IAM Permissions Boundary evaluation logic
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic