Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring a Lambda function named `DataProcessor` in AWS Account A (111122223333111122223333) to write records to an Amazon DynamoDB table in AWS Account B (444455556666444455556666). The Lambda function's execution role is named `LambdaExecutionRole`.

To facilitate cross-account access, the developer creates an IAM role named `CrossAccountDynamoDbRole` in Account B with a permission policy that allows writing to the DynamoDB table. The trust policy for `CrossAccountDynamoDbRole` in Account B is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/LambdaExecutionRole"
},
"Action": "sts:AssumeRole"
}
]
}

Which TWO additional actions must the developer take to enable the Lambda function to write to the DynamoDB table? (Select TWO.)

  1. Attach a permission policy to the Lambda execution role in Account A that allows the sts:AssumeRole action on the ARN of the IAM role in Account B.Answer
  2. Modify the Lambda function code to call the sts:AssumeRole API operation to retrieve temporary credentials, and use those credentials to instantiate the DynamoDB client.Answer
  3. C
    Attach an identity-based policy to the Lambda execution role in Account A that allows dynamodb:PutItem on the ARN of the DynamoDB table in Account B.
  4. D
    Update the trust policy of the IAM role in Account B to include a statement that allows the dynamodb:PutItem action on the DynamoDB table.
  5. E
    Configure the Lambda function environment variables to store the access key ID and secret access key of an IAM user in Account B who has access to the DynamoDB table.

Answer

Attach a permission policy to the Lambda execution role in Account A that allows the sts:AssumeRole action on the IAM role in Account B, and modify the Lambda function code to retrieve temporary credentials using the sts:AssumeRole API operation to initialize the DynamoDB client.
To successfully establish cross-account access via role assumption, a developer must configure both sides of the relationship: the trusting account (Account B) must allow the trusted entity (the Lambda execution role in Account A) to assume the role, and the trusted entity must have permissions to perform the assumption action. Finally, the application code must actively assume the role to acquire temporary credentials for accessing the target resource.

Step-by-Step Solution

1
Configure the identity-based policy in Account A.
Attached a policy to the Lambda execution role that grants permission to assume the cross-account role.
Before an IAM role can be assumed, the caller (Lambda execution role) must be explicitly granted the sts:AssumeRole permission in its identity-based policy.
2
Implement role assumption in the Lambda function code.
The Lambda function uses the AWS SDK to call the sts:AssumeRole API.
Retrieving temporary security credentials for the target role allows the application to authenticate using an identity from the target account (Account B).
3
Initialize the DynamoDB client with temporary credentials.
The DynamoDB client is instantiated using the temporary Access Key ID, Secret Access Key, and Session Token.
This ensures that subsequent PutItem API requests to the DynamoDB table in Account B are authorized under the permissions of the assumed role.

Key Concept

Cross-account IAM role assumption
Rate this question

Topics

IAM Policies and Roles

More questions from this topic