Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is implementing an AWS Lambda function in Account A (111122223333) that needs to retrieve sensitive configuration data from an Amazon S3 bucket located in Account B (444455556666). The developer wants to use the AWS Security Token Service (STS) to assume an IAM role named CrossAccountS3Reader in Account B to access the bucket. The Lambda function runs under an execution role named LambdaExecutionRole in Account A.

Which of the following actions must the developer perform to establish this cross-account access? (Select TWO.)

  1. Modify the trust policy of the CrossAccountS3Reader role in Account B to allow the LambdaExecutionRole ARN from Account A to perform the sts:AssumeRole action.Answer
  2. Attach a permissions policy to the LambdaExecutionRole in Account A that grants sts:AssumeRole permission on the CrossAccountS3Reader role ARN in Account B.Answer
  3. C
    Hardcode the AWS access key ID and secret access key of an IAM user created in Account B directly into the Lambda function's initialization code.
  4. D
    Update the trust policy of the CrossAccountS3Reader role in Account B to specify the service principal lambda.amazonaws.com as the trusted entity.
  5. E
    Attach a resource policy to the Lambda function in Account A that allows the CrossAccountS3Reader role in Account B to push credentials to the function.

Answer

Modifying the trust policy of the target role in Account B to trust the execution role in Account A, and attaching an STS assume role policy to the execution role in Account A.
The correct options state that you must modify the trust policy of the destination role in the target account to trust the source execution role, and attach a policy to the source execution role in the origin account allowing it to assume the destination role. Both parts are mandatory to establish cross-account trust.

Step-by-Step Solution

1
Configure the target role trust relationship
The trust policy of the CrossAccountS3Reader role in Account B is updated to list the ARN of LambdaExecutionRole from Account A as a principal and allow the sts:AssumeRole action.
This establishes trust from the destination account's perspective, permitting the identity from the source account to assume the role.
2
Grant assume role permissions to the source identity
An identity-based permissions policy is attached to LambdaExecutionRole in Account A, allowing the sts:AssumeRole action on the ARN of the CrossAccountS3Reader role.
This grants the source identity the necessary API permission to invoke the AWS STS assume role command.

Key Concept

Establishing cross-account IAM role assumption requires configuring both the trust policy on the target role to trust the source identity, and the identity permissions policy on the source identity to allow the AssumeRole call.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic