Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an AWS Lambda function in Account A (111111111111111111111111) that needs to write items to an Amazon DynamoDB table in Account B (222222222222222222222222). The developer wants to use cross-account IAM roles to implement secure access following the principle of least privilege. An IAM role named `CrossAccountDynamoDBWriter` has been created in Account B with the necessary permission policy to write to the DynamoDB table.

Which two configuration steps must the developer perform to enable the Lambda function to access the DynamoDB table?

  1. In Account B, configure the trust policy of the `CrossAccountDynamoDBWriter` role to allow the Lambda function's execution role in Account A to assume the role.Answer
  2. In Account A, attach an identity-based policy to the Lambda function's execution role that grants the `sts:AssumeRole` permission on the ARN of the `CrossAccountDynamoDBWriter` role in Account B.Answer
  3. C
    In Account A, configure the trust policy of the Lambda function's execution role to trust the `CrossAccountDynamoDBWriter` role in Account B.
  4. D
    In Account A, configure the Lambda function to use hardcoded access keys of an IAM user from Account B that has write access to the DynamoDB table.
  5. E
    In Account A, configure the Lambda function to assume the `CrossAccountDynamoDBWriter` role by adding a resource-based policy directly to the Lambda function.

Answer

In Account B, configure the trust policy of the role to allow the Lambda function's execution role in Account A to assume the role, and in Account A, attach an identity-based policy to the Lambda function's execution role that grants the `sts:AssumeRole` permission on the ARN of the role in Account B.
For cross-account access, a two-way permission handshake is required. The role in the trusting account (Account B) must have a trust policy allowing the trusted identity (Account A's Lambda execution role) to assume it. Concurrently, the trusted identity in Account A must have an identity-based policy allowing it to call `sts:AssumeRole` on the target role in Account B.

Step-by-Step Solution

1
Configure the trust relationship on the target role in Account B.
The `CrossAccountDynamoDBWriter` role in Account B trusts the Lambda function's execution role in Account A.
A role must explicitly declare which identities are trusted to assume it via its trust policy.
2
Grant permission to the Lambda execution role in Account A to perform the assume role action.
The Lambda execution role in Account A is authorized to perform `sts:AssumeRole` on the target role's ARN.
An IAM identity must be explicitly granted permission to perform the `sts:AssumeRole` API call on a target resource.

Key Concept

Cross-account IAM role access requires configuring both a trust policy on the resource role and an identity-based permission policy on the calling principal.
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic