Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

A developer is attempting to deploy an AWS Serverless Application Model (SAM) template using the AWS CLI in an AWS Organizations member account. The developer is assuming an IAM role named `DeploymentRole` which has the `AdministratorAccess` managed policy attached. During the deployment, the CloudFormation stack creation fails with the following error:

`API: lambda:CreateFunction User: arn:aws:iam::123456789012:assumed-role/DeploymentRole/AWSCloudFormation is not authorized to perform: lambda:CreateFunction on resource: arn:aws:lambda:us-east-1:123456789012:function:MySampleFunction`

Which of the following actions should the developer take to resolve this authorization failure? (Select TWO.)

  1. Ensure that the IAM permissions boundary attached to the `DeploymentRole` includes permissions for the `lambda:CreateFunction` action.Answer
  2. Verify that no Service Control Policy (SCP) in AWS Organizations is denying the `lambda:CreateFunction` action on the member account.Answer
  3. C
    Modify the trust policy of the `DeploymentRole` to allow the Lambda service principal (`lambda.amazonaws.com`) to assume the role.
  4. D
    Configure an Amazon Cognito Identity Pool to federate the developer's credentials and grant temporary permissions for the Lambda creation.
  5. E
    Create an API Gateway custom Lambda authorizer to authenticate the deployment requests sent by the AWS CLI.

Answer

Ensure that the IAM permissions boundary attached to the DeploymentRole includes permissions for the lambda:CreateFunction action, and verify that no Service Control Policy (SCP) in AWS Organizations is denying the lambda:CreateFunction action on the member account.
The correct options are to ensure that the IAM permissions boundary attached to the DeploymentRole includes permissions for the lambda:CreateFunction action, and to verify that no Service Control Policy (SCP) in AWS Organizations is denying the action on the member account. In AWS IAM policy evaluation, even if an identity-based policy (such as AdministratorAccess) allows an action, it will be denied if it is not allowed by an active permissions boundary or if it is denied by an SCP, as both function as policy filters that set the maximum allowable permissions.

Step-by-Step Solution

1
Analyze the error message and the current permission configuration.
The deployment role has the AdministratorAccess policy but is still unauthorized to perform the lambda:CreateFunction action.
Since the identity-based policy grants full access, the restriction must originate from a policy type that acts as a guardrail, such as a permissions boundary or a Service Control Policy (SCP).
2
Check the IAM permissions boundary on the DeploymentRole.
Confirm whether a permissions boundary is attached to the role, and verify if it includes permissions for the lambda:CreateFunction action.
Permissions boundaries define the maximum permissions that an IAM entity can have. If the boundary does not allow the action, the action is denied even if AdministratorAccess is attached.
3
Check AWS Organizations Service Control Policies (SCPs) applied to the account.
Verify that no SCP at the Root, OU, or account level denies the lambda:CreateFunction action.
SCPs restrict permissions in member accounts. Any explicit deny in an SCP overrides account-level administrator permissions, causing authorization failures.

Key Concept

Understanding how policy evaluation logic handles administrator permissions when constrained by IAM permissions boundaries and AWS Organizations SCPs.
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic