Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer has deployed an AWS Lambda function named `DataProcessor` in Account A (111111111111111111111111) and configured a Function URL with the authorization type set to `AWS_IAM`. An IAM role named `AppRole` in Account B (222222222222222222222222) needs to invoke this function by sending HTTP requests directly to the Function URL. Which combination of configuration steps will successfully and securely grant `AppRole` the necessary permissions to invoke the Function URL?

  1. A
    Add a resource-based policy to the Lambda function in Account A that grants `lambda:InvokeFunction` permissions to `AppRole`, and attach an identity-based policy to `AppRole` in Account B that allows `lambda:InvokeFunction` on the function ARN in Account A.
  2. B
    Attach an identity-based policy to `AppRole` in Account B that allows `lambda:InvokeFunctionUrl` with the Resource element set to the function's HTTP URL, and add a resource-based policy to the Lambda function in Account A that grants `lambda:InvokeFunctionUrl` to Account B.
  3. Add a resource-based policy to the Lambda function in Account A that grants `lambda:InvokeFunctionUrl` permissions to the Principal `arn:aws:iam::222222222222:role/AppRole`, and attach an identity-based policy to `AppRole` in Account B that allows `lambda:InvokeFunctionUrl` on the function ARN in Account A.Answer
  4. D
    Modify the trust policy of `AppRole` in Account B to trust the AWS Lambda service principal (`lambda.amazonaws.com`), and attach an identity-based policy to `AppRole` allowing `sts:AssumeRole` on the Lambda function ARN in Account A.

Answer

Add a resource-based policy to the Lambda function in Account A that grants `lambda:InvokeFunctionUrl` permissions to the Principal `arn:aws:iam::222222222222:role/AppRole`, and attach an identity-based policy to `AppRole` in Account B that allows `lambda:InvokeFunctionUrl` on the function ARN in Account A.
The correct configuration uses the specific `lambda:InvokeFunctionUrl` action, which is required for Lambda Function URLs. Because the access is cross-account, both the resource-based policy in Account A (which must list the external role ARN as the principal) and the identity-based policy in Account B (which must allow the action on the function ARN) are required.

Step-by-Step Solution

1
Identify the correct IAM action required for Function URL invocations.
The action is `lambda:InvokeFunctionUrl` rather than `lambda:InvokeFunction`.
AWS separates standard API-based invocations (`lambda:InvokeFunction`) from HTTP-based Function URL invocations (`lambda:InvokeFunctionUrl`).
2
Configure permissions for cross-account access.
Permissions must be configured on both the target resource (resource-based policy) and the calling identity (identity-based policy).
For cross-account access, trust must be established bidirectionally: the hosting account must allow the external entity, and the external entity must allow its identity to perform the action on the destination resource.
3
Verify resource identifier compliance in the policy syntax.
The Resource block must reference the Lambda function ARN, not the HTTP URL endpoint.
IAM Resource elements do not support HTTP URLs; they only accept valid AWS Amazon Resource Names (ARNs).

Key Concept

Cross-account IAM authorization for AWS Lambda Function URLs
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic