Examkin

Question

Difficulty: EasyIAM Policies and Roles

A developer is configuring an AWS Lambda function that needs to retrieve objects from an Amazon S3 bucket. Which of the following configurations represents the most secure method to grant the Lambda function the necessary permissions to access the S3 bucket?

  1. A
    Create an IAM role with a permissions policy allowing s3:GetObject, and configure the trust policy of the role to allow the s3.amazonaws.com service principal to assume it.
  2. Create an IAM execution role with a permissions policy that allows s3:GetObject on the specific bucket, configure the trust policy of the role to allow the lambda.amazonaws.com service principal to assume it, and associate this role with the Lambda function.Answer
  3. C
    Initialize the AWS SDK client inside the Lambda function code using hardcoded AWS access keys of an IAM user that has read access to the S3 bucket.
  4. D
    Assign an ECS Task Execution Role containing the necessary S3 permissions to the Lambda function configuration.

Answer

Create an IAM execution role with a permissions policy that allows s3:GetObject on the specific bucket, configure the trust policy of the role to allow the lambda.amazonaws.com service principal to assume it, and associate this role with the Lambda function.
The correct answer correctly specifies creating an IAM execution role, defining its permissions policy to allow s3:GetObject, configuring its trust policy to allow lambda.amazonaws.com to assume it, and associating the role with the Lambda function. This follows the principle of least privilege and uses secure, temporary credentials.

Step-by-Step Solution

1
Determine the resource access model.
AWS Lambda functions assume execution roles to get temporary credentials for other AWS services.
This avoids hardcoding long-lived access keys in code or environment variables.
2
Define the IAM execution role components.
The role must have a trust policy for the Lambda service principal (lambda.amazonaws.com) and a permissions policy for s3:GetObject on the bucket.
The trust policy allows Lambda to assume the role, while the permissions policy allows the assumed role to access S3.
3
Associate the role.
Attach the configured IAM execution role to the Lambda function configuration.
This grants the Lambda function instance the identity and temporary credentials of the role during execution.

Key Concept

IAM Execution Roles for AWS Lambda
Rate this question

Topics

IAM Policies and Roles

More questions from this topic