Examkin

Question

Difficulty: MediumAWS Serverless Application Model (SAM)

A software team is designing a serverless microservice using the AWS Serverless Application Model (SAM). The architecture requires an API Gateway HTTP API that triggers a backend AWS Lambda function. The function must securely fetch database credentials at runtime and also publish messages to an Amazon SQS queue.

Which two configuration steps must be implemented to ensure the deployment succeeds and the function operates correctly?

  1. Declare the 'Transform' header with the value 'AWS::Serverless-2016-10-31' at the root of the template file to instruct CloudFormation to process the SAM syntax.Answer
  2. Under the function's Properties block in the template, define the 'Policies' key referencing the 'SQSSendMessagePolicy' SAM policy template with the target queue name.Answer
  3. C
    Define a custom IAM execution role for the function and modify its trust policy to specify the SQS service principal ('sqs.amazonaws.com') as the trusted entity.
  4. D
    Store the database password in AWS Systems Manager Parameter Store as a standard string parameter, and reference it directly in the environment variables block.
  5. E
    Configure the Lambda function to return a plain text string payload, because API Gateway proxy integrations automatically format raw string return values into standard JSON responses.

Answer

The correct configurations are to declare the 'Transform' header with the value 'AWS::Serverless-2016-10-31' at the root of the template, and define the 'Policies' key referencing the 'SQSSendMessagePolicy' SAM policy template under the function's properties block.
Declaring the 'Transform' header with 'AWS::Serverless-2016-10-31' is mandatory for AWS SAM templates to convert serverless resource declarations into standard CloudFormation resources. Additionally, using the 'SQSSendMessagePolicy' template under the function's 'Policies' block is the standard, secure way in SAM to grant write permissions to an SQS queue without writing a full, custom IAM policy.

Step-by-Step Solution

1
Ensure the AWS SAM template contains the required header to parse SAM resource types.
The template includes 'Transform: AWS::Serverless-2016-10-31' at the root, enabling CloudFormation to recognize AWS::Serverless resource types.
Without this transform declaration, CloudFormation will fail to deploy, treating SAM resources as invalid.
2
Grant the Lambda function permission to send messages to the SQS queue using SAM policy templates.
The 'Policies' property under the Lambda function resource is configured with the 'SQSSendMessagePolicy' template pointing to the queue.
Using built-in SAM policy templates is the recommended method to grant granular permissions to a function efficiently.
3
Verify and avoid common security and integration misconfigurations.
IAM trust policies are set to 'lambda.amazonaws.com', database secrets are stored securely in Secrets Manager (not standard SSM parameter strings), and the function returns the correct proxy response format.
This prevents runtime integration failures, permission issues, and credential leakage.

Key Concept

AWS SAM templates require a Transform declaration at the root and support SAM policy templates to securely grant AWS resource permissions to serverless functions.
Estimated Time:2m 0s
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic