Question

Difficulty: EasyIAM Policies and Roles

A developer is configuring an AWS Lambda function that needs to read objects from an Amazon S3 bucket. The developer creates an IAM role containing the following permission policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-app-data/*"
}
]
}

Which configuration must be applied to the trust policy of this IAM role so that the Lambda function can successfully assume it?

  1. A
    A trust policy that grants the ec2.amazonaws.com service principal permission to perform the sts:AssumeRole action
  2. A trust policy that grants the lambda.amazonaws.com service principal permission to perform the sts:AssumeRole actionAnswer
  3. C
    No trust policy is required; instead, the developer should initialize the AWS SDK client using static credentials of an IAM user hardcoded in the function code
  4. D
    A trust policy that grants the ecs-tasks.amazonaws.com service principal permission to perform the sts:AssumeRole action

Answer

A trust policy that grants the lambda.amazonaws.com service principal permission to perform the sts:AssumeRole action
For an AWS service like AWS Lambda to execute code and access other AWS resources, it must assume an IAM execution role. This requires a trust policy attached to the role that explicitly allows the 'lambda.amazonaws.com' service principal to call 'sts:AssumeRole'.

Step-by-Step Solution

1
Identify the AWS service attempting to assume the IAM role.
The service is AWS Lambda.
The execution environment requires the Lambda service principal to acquire temporary credentials.
2
Verify the correct service principal name for AWS Lambda.
The principal is lambda.amazonaws.com.
Each AWS service has a specific principal identifier used in trust policies.
3
Determine the API action required for assuming a role.
The action is sts:AssumeRole.
The Security Token Service (STS) action sts:AssumeRole is required to delegate access to services or accounts.

Key Concept

IAM trust policies define which principals (users, accounts, or services) are allowed to assume an IAM role.
Rate this question