Examkin

Question

Difficulty: EasyResolving IAM and Authorization Failures

A developer has configured an AWS Lambda function in AWS Account A to send messages to an Amazon Simple Queue Service (Amazon SQS) queue located in AWS Account B. During execution, the Lambda function fails with an AccessDenied error when attempting to write to the queue. Which two actions are required to resolve this authorization failure? (Select TWO.)

  1. Add a policy to the Lambda function's IAM execution role in Account A that allows the sqs:SendMessage action on the queue in Account B.Answer
  2. Update the SQS queue policy in Account B to grant the Lambda function's IAM execution role in Account A permission to perform the sqs:SendMessage action.Answer
  3. C
    Modify the IAM trust policy of the SQS queue in Account B to trust the Lambda service principal.
  4. D
    Configure the Lambda function to use an Amazon Cognito Identity Pool to obtain temporary credentials to write to Account B.
  5. E
    Hardcode the AWS Access Key ID and Secret Access Key of an IAM user from Account B in the Lambda function's initialization code.

Answer

Add a policy to the Lambda function's IAM execution role in Account A that allows the sqs:SendMessage action on the queue in Account B, and update the SQS queue policy in Account B to grant the Lambda function's IAM execution role in Account A permission to perform the sqs:SendMessage action.
The correct answers describe the two necessary steps for cross-account resource access: granting identity-based permissions to the caller's IAM execution role in the source account and granting resource-based permissions in the queue's policy in the target account to allow access from that execution role principal.

Step-by-Step Solution

1
Add the appropriate SQS permission to the Lambda execution role.
The execution role in Account A now has identity-based permission to call sqs:SendMessage on the SQS queue in Account B.
For cross-account access, the requesting identity must explicitly be allowed to perform the action in its own policy.
2
Add permissions to the SQS queue resource policy.
The SQS queue policy in Account B allows the execution role ARN from Account A to perform sqs:SendMessage.
Cross-account access requires explicit permission on the resource-based policy of the target resource to allow access from an external account.

Key Concept

Cross-account resource access requires authorization in both the caller's IAM identity-based policy and the target's resource-based policy.
Estimated Time:1m 0s
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic