Examkin

Question

Difficulty: EasyIAM Policies and Roles

A developer is creating an IAM role that will be used by an AWS Lambda function to access other AWS resources. The developer needs to ensure that the AWS Lambda service itself is authorized to assume this role. Which type of policy must the developer configure to define which service principal can assume the role?

  1. An IAM trust policyAnswer
  2. B
    An identity-based permissions policy
  3. C
    A resource-based policy on the Lambda function
  4. D
    An IAM permissions boundary

Answer

An IAM trust policy
An IAM trust policy (also known as an assume role policy document) defines the trust relationship for an IAM role. It is a resource-based policy attached to the role itself that specifies which security principals (such as the AWS Lambda service principal, 'lambda.amazonaws.com') are allowed to assume the role using the STS AssumeRole API.

Step-by-Step Solution

1
Identify the goal: granting permission for a service principal (AWS Lambda) to assume an IAM role.
The configuration required is a delegation of trust to a service.
Before a service can act on behalf of a user, it must be trusted to assume the execution role.
2
Differentiate between policy types: trust policies versus permissions policies.
Trust policies specify the principal (who can assume the role), while permissions policies specify the actions and resources (what the role can do).
An IAM role contains both a trust policy and permissions policies.
3
Select the policy type that governs the assume role action.
The trust policy contains the 'AssumeRole' action and designates 'lambda.amazonaws.com' as the trusted principal.
This configuration allows AWS Lambda to assume the execution role and obtain temporary security credentials.

Key Concept

IAM Trust Policies vs. Permissions Policies
Rate this question

Topics

IAM Policies and Roles

More questions from this topic