A developer is creating an AWS Lambda function that processes files uploaded to an Amazon S3 bucket. The developer creates an IAM role named `S3ProcessRole` with the required S3 permission policies. However, when trying to assign the role to the Lambda function, the developer receives an error indicating that the role cannot be assumed by Lambda. The developer inspects the role's trust policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::987654321098:root"
},
"Action": "sts:AssumeRole"
}
]
}
Which modification to the trust policy is required to resolve this error?
- Update the Principal block in the trust policy to specify "Service": "lambda.amazonaws.com".Answer
- BAdd the required s3:GetObject and s3:PutObject permissions to the Action block of the trust policy.
- CChange the Action in the trust policy from sts:AssumeRole to lambda:InvokeFunction.
- DInitialize the AWS SDK client inside the Lambda function code using hardcoded AWS access keys to bypass the role assignment.
Answer
Update the Principal block in the trust policy to specify the Lambda service principal.
The correct answer is to modify the Principal block to allow the AWS Lambda service principal (lambda.amazonaws.com) to assume the role. When Lambda runs a function, it must assume the execution role via the sts:AssumeRole action. For this to succeed, the role's trust policy must explicitly trust the Lambda service principal.
Step-by-Step Solution
Key Concept
IAM Role Trust Policies vs. Permissions Policies
Estimated Time:1m 30s