Examkin

Question

Difficulty: HardAWS Serverless Application Model (SAM)

A developer writes an AWS Serverless Application Model (SAM) template to deploy a Lambda function that reads objects from an Amazon S3 bucket. The template is configured as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
ProcessUploadsFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: ./src
Handler: index.handler
Runtime: nodejs18.x
Policies:
- S3ReadPolicy

When executing `sam deploy`, the deployment fails with a CloudFormation template validation or parsing error. Which of the following describes the root cause of this deployment failure and the correct resolution?

  1. The S3ReadPolicy template requires a parameter. The developer must specify the target bucket name by structuring the policy as an object with the BucketName property.Answer
  2. B
    The template lacks the required Transform declaration at the root level, causing CloudFormation to fail to parse serverless resources.
  3. C
    The execution role for the function lacks a trust relationship policy. The developer must manually configure an IAM trust policy to trust the Lambda service.
  4. D
    The function lacks credentials to read from the bucket. The developer must retrieve the credentials using a Systems Manager Parameter Store dynamic reference.

Answer

The S3ReadPolicy template requires a parameter, meaning the developer must specify the target bucket name by structuring the policy as an object with the BucketName property.
AWS SAM policy templates allow developers to easily scope permissions for Lambda functions. However, many policy templates (such as `S3ReadPolicy`) require parameters to be explicitly defined. Specifying the policy template name as a string element under the `Policies` list is invalid when parameters are required. The correct approach is to define it as an object with the required parameters (e.g., `S3ReadPolicy` mapped to a nested `BucketName` property).

Step-by-Step Solution

1
Examine the Policies property configuration in the SAM template.
The template defines the policy as a string element in a list: `- S3ReadPolicy`.
To identify why the validation or parsing error occurred during deployment.
2
Review the requirements for the AWS SAM S3ReadPolicy template.
The S3ReadPolicy requires the `BucketName` parameter to scope the read permissions to a specific S3 bucket.
To determine whether the policy template requires arguments or can be used as a simple string.
3
Reformat the policy definition to supply the required parameter.
Change the policy definition to a key-value object containing the policy template name and the bucket reference.
To satisfy the parameter validation requirements of the SAM translator.

Key Concept

AWS SAM Policy Templates Parameter Requirements
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic