Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

A developer is writing an AWS Lambda function in AWS Account A (111111111111111111111111) that needs to retrieve files from an Amazon S3 bucket located in AWS Account B (222222222222222222222222). The developer has attached an IAM policy to the Lambda function's execution role in Account A that grants `s3:GetObject` permissions on the S3 bucket in Account B. However, when the Lambda function runs, it receives an Access Denied error (HTTP 403403) from Amazon S3. Which of the following actions will resolve this authorization failure?

  1. Add a bucket policy to the S3 bucket in Account B that explicitly grants the Lambda execution role ARN in Account A permission to perform the s3:GetObject action.Answer
  2. B
    Update the trust policy of the Lambda execution role in Account A to allow the S3 service in Account B to assume the role.
  3. C
    Initialize the Amazon S3 client in the Lambda function using hardcoded AWS access keys from an IAM user in Account B who has access to the bucket.
  4. D
    Create an Amazon Cognito Identity Pool in Account B, configure it to authenticate the Lambda function, and use the retrieved temporary credentials to access the bucket.

Answer

Add a bucket policy to the S3 bucket in Account B that explicitly grants the Lambda execution role ARN in Account A permission to perform the s3:GetObject action.
For cross-account access to Amazon S3, both the identity-based policy in the source account (Account A) and the resource-based policy (bucket policy) in the destination account (Account B) must explicitly grant permission. Adding a bucket policy in the destination account that allows the source account's Lambda execution role to perform the object retrieval action satisfies the second requirement.

Step-by-Step Solution

1
Identify the authorization boundary for cross-account S3 access.
Determine that the request crosses AWS accounts, requiring authorization from both the source (Account A) and destination (Account B).
Unlike same-account S3 access, cross-account access requires permissions to be granted explicitly on both the identity-based policy and the resource-based policy.
2
Evaluate the existing configuration.
Confirm that the identity-based policy on the Lambda execution role in Account A already allows s3:GetObject on the target resource.
Since the IAM role is configured correctly, the authorization failure points to a missing resource-based permission on the destination bucket.
3
Configure the destination S3 bucket policy.
Add an S3 bucket policy in Account B designating the Lambda execution role from Account A as the Principal, and allowing the s3:GetObject action.
This establishes the necessary trust relationship at the resource level, enabling the Lambda function to retrieve the objects successfully.

Key Concept

Cross-Account IAM Delegation and Resource-Based Policies
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic