Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an AWS Lambda function in Account A (111122223333111122223333) to write data to an Amazon DynamoDB table in Account B (444455556666444455556666) by assuming an IAM role named `CrossAccountDynamoDBRole` in Account B. The Lambda function's execution role in Account A is named `LambdaExecutionRole`.

When the Lambda function invokes the `AssumeRole` API call using the AWS SDK, the execution fails with the following error:
`User: arn:aws:sts::111122223333:assumed-role/LambdaExecutionRole/my-function is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole`

Which TWO configurations must the developer implement to resolve this error?

  1. Add a permission policy to the LambdaExecutionRole in Account A that allows the sts:AssumeRole action on arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.Answer
  2. Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the sts:AssumeRole action for the principal arn:aws:iam::111122223333:role/LambdaExecutionRole.Answer
  3. C
    Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the dynamodb:PutItem action for the principal lambda.amazonaws.com.
  4. D
    Add a permission policy to the LambdaExecutionRole in Account A that allows the dynamodb:PutItem action on the DynamoDB table in Account B.
  5. E
    Hardcode the AWS access keys of an IAM user created in Account B directly into the Lambda function's initialization code.

Answer

To allow the Lambda function to perform cross-account access, the developer must grant the sts:AssumeRole permission to the Lambda execution role in Account A and configure the target role in Account B to trust the Lambda execution role in Account A.
The correct configurations involve setting up both sides of the trust boundary. First, the calling role in Account A must be granted permission to perform the sts:AssumeRole action. Second, the trust policy of the target role in Account B must be updated to trust the calling role in Account A as the principal.

Step-by-Step Solution

1
Analyze the error message and the configuration requirements.
The error indicates that the Lambda execution role in Account A is not authorized to perform sts:AssumeRole on the cross-account role in Account B.
For cross-account role assumption to succeed, two permissions must match: the caller role must have a permission policy allowing sts:AssumeRole, and the destination role must have a trust policy allowing the caller role to assume it.
2
Configure the calling side (Account A).
Attach an IAM policy to the LambdaExecutionRole allowing the action sts:AssumeRole on the resource arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.
This grants the source role the necessary authorization to call the STS AssumeRole API.
3
Configure the receiving side (Account B).
Update the trust policy of CrossAccountDynamoDBRole to specify the ARN of the LambdaExecutionRole (arn:aws:iam::111122223333:role/LambdaExecutionRole) as the principal and allow sts:AssumeRole.
This establishes the trust relationship, allowing the principal from Account A to assume the role in Account B.

Key Concept

Cross-account IAM role assumption requires configuration on both the source account (identity policy permitting sts:AssumeRole) and the destination account (trust policy permitting the source identity).
Rate this question

Topics

IAM Policies and Roles

More questions from this topic