A developer is configuring an AWS Lambda function that needs to read objects from an Amazon S3 bucket. The developer creates an IAM role containing the following permission policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-app-data/*"
}
]
}
Which configuration must be applied to the trust policy of this IAM role so that the Lambda function can successfully assume it?
- AA trust policy that grants the ec2.amazonaws.com service principal permission to perform the sts:AssumeRole action
- A trust policy that grants the lambda.amazonaws.com service principal permission to perform the sts:AssumeRole actionAnswer
- CNo trust policy is required; instead, the developer should initialize the AWS SDK client using static credentials of an IAM user hardcoded in the function code
- DA trust policy that grants the ecs-tasks.amazonaws.com service principal permission to perform the sts:AssumeRole action
Answer
A trust policy that grants the lambda.amazonaws.com service principal permission to perform the sts:AssumeRole action
For an AWS service like AWS Lambda to execute code and access other AWS resources, it must assume an IAM execution role. This requires a trust policy attached to the role that explicitly allows the 'lambda.amazonaws.com' service principal to call 'sts:AssumeRole'.
Step-by-Step Solution
Key Concept
IAM trust policies define which principals (users, accounts, or services) are allowed to assume an IAM role.