Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer is setting up an AWS Lambda function that must read from an Amazon DynamoDB table. The developer creates an IAM role named AppStoreExecutionRole and attaches a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations. However, when invoking the Lambda function, it fails to execute with an authorization error because it cannot assume the role. The role's current trust policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy will resolve this authorization error?

  1. A
    Attach a permissions policy to the role that allows the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.
  2. Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.Answer
  3. C
    Update the trust policy's Action block to allow lambda:InvokeFunction instead of sts:AssumeRole.
  4. D
    Configure the Lambda function's application code to call the Security Token Service (STS) AssumeRole API using the AWS SDK during initialization.

Answer

Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.
The correct answer is to update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal. AWS Lambda requires that any execution role assigned to a function trusts the Lambda service principal so that AWS Lambda can assume the role when invoking the function on the developer's behalf.

Step-by-Step Solution

1
Examine the trust policy's Principal and Action fields.
The trust policy currently delegates trust only to the root account identifier, meaning only IAM identities within account 123456789012 who have sts:AssumeRole permissions can assume it.
To identify why the AWS Lambda service is blocked from assuming the execution role.
2
Determine how the AWS Lambda service assumes roles to execute functions.
AWS Lambda requires the service principal lambda.amazonaws.com to be declared as the trusted entity in the trust policy.
The Lambda service itself, not an IAM identity inside the account, is initiating the sts:AssumeRole call.
3
Replace the AWS account principal reference with the Lambda service principal.
The trust policy is updated to permit the lambda.amazonaws.com service principal to perform sts:AssumeRole.
This allows AWS Lambda to assume the role when running the function, resolving the initialization error.

Key Concept

IAM trust policies define which principals (users, accounts, or services) are allowed to assume a role. For AWS services like Lambda to assume a role, the trust policy must explicitly grant the sts:AssumeRole action to the service's principal name (e.g., lambda.amazonaws.com).
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic