Examkin

Question

Difficulty: Very hardAWS Serverless Application Model (SAM)

A developer is using AWS SAM to deploy a serverless application consisting of an API Gateway endpoint that triggers a Lambda function, which writes data to a DynamoDB table. The template is defined as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
ProcessTransactionFunction:
Type: 'AWS::Serverless::Function'
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
PostTransaction:
Type: Api
Properties:
Path: /transaction
Method: post
Role: !GetAtt LambdaExecutionRole.Arn

LambdaExecutionRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- apigateway.amazonaws.com
Action:
- 'sts:AssumeRole'
Policies:
- PolicyName: DynamoDBWritePolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- 'dynamodb:PutItem'
Resource: !GetAtt TransactionTable.Arn

During the deployment process using the AWS SAM CLI, the deployment fails with a parser error indicating that the resource type `AWS::Serverless::Function` is invalid. Additionally, if the parsing error is resolved, the Lambda function will fail to execute due to execution role issues.

Which two modifications must the developer make to ensure the template parses successfully and the Lambda function can be successfully assumed and executed by the AWS Lambda service?

  1. Add Transform: AWS::Serverless-2016-10-31 at the root level of the template.Answer
  2. Update the trust policy of LambdaExecutionRole to list lambda.amazonaws.com as the service principal.Answer
  3. C
    Update the execution policy of the IAM role to include the lambda:InvokeFunction action on the ProcessTransactionFunction resource.
  4. D
    Modify the Lambda function handler code to return a raw text response since the default configuration for the SAM Api event source uses custom integration.
  5. E
    Add a default Timeout property set to 900 seconds under the Globals section to prevent execution context reuse timeouts during deployment validation.

Answer

To resolve the issues, the developer must add the Transform declaration to the root level of the template, and update the execution role trust policy to list the Lambda service principal.
Adding the Transform header enables the CloudFormation service to parse the AWS SAM syntax. Changing the service principal in the trust policy to lambda.amazonaws.com allows the Lambda service to assume the execution role and run the function.

Step-by-Step Solution

1
Analyze the template syntax error.
Identify that the parser failed on 'AWS::Serverless::Function' because the AWS SAM transform macro statement is missing.
Without the Transform declaration, CloudFormation does not recognize resources in the AWS::Serverless namespace.
2
Analyze the IAM Role trust policy configuration.
Identify that the trust policy lists 'apigateway.amazonaws.com' as the service principal in the Principal section.
The execution role must be assumed by the Lambda service, meaning the service principal must be lambda.amazonaws.com.
3
Determine the necessary changes.
Formulate the fixes: insert the Transform line and update the service principal in the trust policy.
These changes address both the parsing failure and the runtime execution permission failure.

Key Concept

AWS SAM templates require the Transform header to compile serverless resources, and Lambda execution roles require the correct trust policy configuration to allow the Lambda service to assume the role.
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic