A developer is configuring an AWS Lambda function to process messages from an Amazon SQS queue using an event source mapping. The Lambda function has an execution role with the following permissions policy attached:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage"
],
"Resource": "arn:aws:sqs:us-east-1:123456789012:ProcessQueue"
}
]
}
When the developer attempts to create the event source mapping, the operation fails with an error indicating that the Lambda function does not have sufficient permissions to read from the queue.
Which of the following actions should the developer take to successfully configure the event source mapping?
- Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.Answer
- BModify the trust policy of the Lambda execution role to list "sqs.amazonaws.com" as the principal allowed to perform the "sts:AssumeRole" action.
- CAdd a statement to the SQS queue's resource-based policy that allows the Lambda execution role to perform the "sts:AssumeRole" action on the queue.
- DModify the Lambda function code to initialize the AWS SDK client by retrieving and hardcoding temporary access keys from the queue's metadata attributes.
Answer
Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.
The correct answer is correct because AWS Lambda requires the `sqs:GetQueueAttributes` permission in addition to `sqs:ReceiveMessage` and `sqs:DeleteMessage` to set up and manage an SQS event source mapping successfully. This permission allows Lambda to read parameters such as the visibility timeout and approximate message count.
Step-by-Step Solution
Key Concept
Permissions required for SQS event source mappings in Lambda execution roles
Estimated Time:1m 30s