Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an AWS Lambda function in Account A (123456789012123456789012) to write data to an Amazon DynamoDB table in Account B (210987654321210987654321). The developer wants to use a cross-account IAM role named `DynamoDBWriterRole` in Account B to perform the DynamoDB operations. The Lambda function runs under an execution role named `LambdaExecutionRole` in Account A. Which two configurations are required to establish this cross-account trust and allow the Lambda function to write to the table? (Select TWO.)

  1. A trust policy attached to the role in Account B that specifies the Lambda execution role in Account A as the principal and allows the sts:AssumeRole action.Answer
  2. An IAM permissions policy attached to the Lambda execution role in Account A that allows the sts:AssumeRole action on the Amazon Resource Name (ARN) of the role in Account B.Answer
  3. C
    An IAM permissions policy attached to the role in Account B that allows sts:AssumeRole for the dynamodb.amazonaws.com service principal.
  4. D
    Function code changes to hardcode temporary AWS access keys generated from the Account B IAM console within the AWS SDK initialization.
  5. E
    A trust policy attached to the role in Account B that grants the sts:AssumeRole permission to the dynamodb.amazonaws.com service principal.

Answer

To configure cross-account access, the developer must attach a trust policy to the role in Account B that lists the Lambda execution role in Account A as a principal and allows the sts:AssumeRole action. In addition, the developer must attach an IAM permissions policy to the Lambda execution role in Account A allowing the sts:AssumeRole action on the target role's ARN in Account B.
Establishing cross-account delegation requires both sides to agree: the target role's trust policy in Account B must trust the calling IAM entity in Account A, and the calling identity in Account A must be granted permission in its identity policy to assume that target role.

Step-by-Step Solution

1
Configure the trust relationship on the target role in Account B.
The target role (DynamoDBWriterRole) trust policy is updated to permit the Lambda execution role ARN in Account A to perform sts:AssumeRole.
This establishes that the role in Account B trusts the specific entity in Account A to assume it.
2
Add permissions to the source Lambda execution role in Account A.
The Lambda execution role in Account A is granted identity-based permissions to call sts:AssumeRole on the ARN of DynamoDBWriterRole.
The entity in the source account must have permissions to initiate the AssumeRole call.
3
Implement the sts:AssumeRole API call in the Lambda function code.
The Lambda function uses the AWS SDK to retrieve temporary security credentials and uses them to write to the DynamoDB table.
This allows the function to execute operations with the authorization level of the target role in Account B.

Key Concept

Cross-account IAM Role Delegation
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic