Examkin

Question

Difficulty: MediumAWS Serverless Application Model (SAM)

An engineer is deploying a serverless application using a template that defines a Lambda function triggered by an Amazon S3 event. The function needs to execute with a custom IAM role. During the deployment, the stack fails to create the resources successfully. The relevant section of the template is structured as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
ProcessFileFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs20.x
Role: !GetAtt ProcessingRole.Arn
ProcessingRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal: Service: s3.amazonaws.com
Action: sts:AssumeRole

Which of the following modifications will resolve the deployment failure and allow the Lambda function to assume the role?

  1. Update the Service principal under the AssumeRolePolicyDocument of the ProcessingRole to lambda.amazonaws.com.Answer
  2. B
    Add a Transform: AWS::Serverless-2016-10-31 declaration inside the Properties section of the ProcessingRole.
  3. C
    Change the event source integration format to Lambda Proxy (AWS_PROXY) within the S3 bucket configuration.
  4. D
    Increase the Timeout property of the AWS::Serverless::Function resource to allow S3 more time to assume the execution role.

Answer

Update the Service principal under the AssumeRolePolicyDocument of the ProcessingRole to lambda.amazonaws.com.
The correct answer updates the Service principal in the trust policy to lambda.amazonaws.com. An IAM execution role for a Lambda function must have a trust relationship that allows the lambda.amazonaws.com service principal to perform the sts:AssumeRole action. Even though the function is triggered by S3, the S3 service does not assume the Lambda execution role directly; instead, S3 invokes the function, and the Lambda service assumes the role to execute the function runtime.

Step-by-Step Solution

1
Analyze the resource definitions in the template.
The template defines an AWS::Serverless::Function and a custom AWS::IAM::Role named ProcessingRole.
To understand the relationship between the Lambda function execution role and its configuration.
2
Inspect the AssumeRolePolicyDocument of the custom role.
The trust policy has the Service principal set to s3.amazonaws.com.
The trust policy dictates which AWS service or identity is allowed to assume the role. The Lambda execution role must be assumed by the AWS Lambda service (lambda.amazonaws.com) to execute the function code, not the event source (s3.amazonaws.com).
3
Select the correction that updates the trust relationship correctly.
Changing the principal service to lambda.amazonaws.com allows AWS Lambda to assume the role.
This establishes the correct trust relationship so the execution role can be successfully used by the function.

Key Concept

AWS Lambda Execution Role Trust Policy
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic