Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an AWS Lambda function in Account A (111122223333) to send logs and processing data directly to an Amazon SQS queue located in Account B (444455556666). The Lambda function is associated with an IAM execution role named LambdaSQSSenderRole. When the Lambda function attempts to call the SQS SendMessage API, it receives an AccessDeniedException. Which two actions are required to resolve this authorization issue and allow the Lambda function to send messages to the queue? (Select two.)

  1. Attach an IAM policy to the LambdaSQSSenderRole in Account A that allows the sqs:SendMessage action on the ARN of the SQS queue in Account B.Answer
  2. Configure the queue policy on the SQS queue in Account B to allow the sqs:SendMessage action with the Principal set to the LambdaSQSSenderRole ARN.Answer
  3. C
    Modify the trust policy of the LambdaSQSSenderRole in Account A to trust the SQS service principal (sqs.amazonaws.com).
  4. D
    Configure the Lambda function environment variables to store hardcoded AWS access keys of an IAM user in Account B who has access to the queue, and use them to initialize the AWS SDK client.
  5. E
    Update the SQS queue policy in Account B to set the Principal to the Account A ID and set the Resource block to the ARN of the LambdaSQSSenderRole.

Answer

Attach an IAM policy to the LambdaSQSSenderRole in Account A that allows the sqs:SendMessage action on the ARN of the SQS queue in Account B, and configure the queue policy on the SQS queue in Account B to allow the sqs:SendMessage action with the Principal set to the LambdaSQSSenderRole ARN.
For cross-account access to resource-based services like SQS, permissions must be granted on both sides. The caller in Account A (the Lambda execution role) must be allowed by its identity policy to send messages to the external queue. Simultaneously, the resource policy in Account B (the SQS queue policy) must allow the execution role from Account A to write to the queue.

Step-by-Step Solution

1
Configure identity-based policy in Account A
The Lambda function's execution role has outbound permissions to send messages to the external SQS queue.
By default, IAM execution roles do not have permission to write to resources in other accounts. An identity-based policy must explicitly grant the sqs:SendMessage action on the destination SQS queue ARN.
2
Configure resource-based policy in Account B
The SQS queue allows incoming messages from the execution role in Account A.
For cross-account access, both the identity-based policy in the source account and the resource-based policy in the target account must permit the access. The SQS queue policy must specify the IAM role ARN as the principal.

Key Concept

Cross-account resource access requires authorization in both the source account's identity-based policy and the target account's resource-based policy.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic