Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

An organization has an AWS Lambda function running in Account A (111122223333111122223333). The Lambda function needs to be triggered by an Amazon SQS queue located in Account B (444455556666444455556666). A developer is configuring a cross-account event source mapping in Account A to process messages from the queue. During setup, the event source mapping enters an `ERR` status with a permission-related error.

Which combination of actions will resolve this authorization failure? (Choose two.)

  1. Update the Lambda function's IAM execution role policy in Account A to grant permission for `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` on the SQS queue's ARN in Account B.Answer
  2. Update the SQS queue policy in Account B to grant `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` permissions to the ARN of the Lambda function's execution role in Account A.Answer
  3. C
    Update the trust policy of the Lambda execution role in Account A to allow the SQS service principal (`sqs.amazonaws.com`) to assume the role.
  4. D
    Modify the Lambda function code to initialize the SQS client using hardcoded temporary AWS access keys and secret keys generated from Account B.
  5. E
    Create an Amazon Cognito Identity Pool in Account B to authenticate the Lambda function and issue temporary credentials allowing SQS access.

Answer

Updating the Lambda function's execution role policy in Account A to allow SQS actions on the Account B queue, and updating the SQS queue policy in Account B to allow the Lambda execution role ARN.
To configure a cross-account SQS event source mapping, the Lambda function's execution role in Account A must be granted IAM permissions to receive, delete, and get attributes from the queue in Account B. Additionally, the SQS queue policy in Account B must be updated to trust and grant those same permissions to the Lambda function's execution role ARN in Account A.

Step-by-Step Solution

1
Identify the Lambda execution role ARN in Account A and the SQS queue ARN in Account B.
Obtained the unique identifiers needed to configure the cross-account permissions.
Both ARNs are needed to configure the resource policies and IAM policies correctly.
2
Modify the Lambda execution role's permissions policy in Account A.
Granted sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes permissions on the Account B SQS queue ARN.
Allows the Lambda service (acting on behalf of the function) to access the SQS queue in the other account.
3
Modify the SQS queue resource policy in Account B.
Added a statement allowing the Lambda execution role ARN from Account A to perform sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes.
Grants cross-account access at the resource level, allowing the external role from Account A to access Account B's SQS queue.

Key Concept

Cross-account authorization for poll-based event sources (SQS) in AWS Lambda requires both identity-based policies (on the Lambda execution role) and resource-based policies (on the SQS queue) to grant permissions.
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic