A developer is configuring an AWS Lambda function with the execution role `arn:aws:iam::123456789012:role/MyLambdaExecutionRole`. The Lambda function needs to temporarily assume a different IAM role named `arn:aws:iam::123456789012:role/TargetReportingRole` to perform analytical reporting. During execution, the Lambda function code calls the AWS Security Token Service (AWS STS) `AssumeRole` API but fails with an `AccessDenied` error. Which of the following configurations are required to successfully allow this role assumption? (Select TWO.)
- A permission policy attached to MyLambdaExecutionRole that allows the sts:AssumeRole action on the TargetReportingRole resourceAnswer
- A trust policy on TargetReportingRole that allows the principal MyLambdaExecutionRole to perform the sts:AssumeRole actionAnswer
- CA trust policy on MyLambdaExecutionRole that allows TargetReportingRole to perform the sts:AssumeRole action
- DA resource-based policy attached to TargetReportingRole that grants the sts:AssumeRole permission to MyLambdaExecutionRole
- EHardcoded temporary credentials of an IAM User with AdministratorAccess initialized directly in the Lambda function code
Answer
To allow the Lambda function to assume the target role, you must attach a permission policy to the Lambda execution role allowing the sts:AssumeRole action on the target role's ARN, and configure the target role's trust policy to trust the Lambda execution role.
For an IAM entity to assume an IAM role, two conditions must be met: the caller's identity-based policy must explicitly allow the sts:AssumeRole action on the target role's resource ARN, and the target role's trust policy must list the caller's role ARN as a trusted principal for the sts:AssumeRole action.
Step-by-Step Solution
Key Concept
IAM role assumption requires a two-way configuration: permissions on the caller (identity-based policy) and trust on the receiver (trust policy).