Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is attempting to deploy an AWS Lambda function that reads data from an Amazon DynamoDB table. The developer has created an IAM role named `DynamoDbReaderRole` with a permissions policy that grants `dynamodb:GetItem` and `dynamodb:Query` access. However, when the developer tries to deploy the Lambda function and associate it with `DynamoDbReaderRole` using the AWS CLI, the deployment fails with an error indicating that Lambda is not authorized to assume the role, and that the developer is not authorized to perform `iam:PassRole` on the resource.

Which TWO actions must the developer take to successfully deploy the Lambda function? (Select TWO.)

  1. Modify the trust policy of `DynamoDbReaderRole` to allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action.Answer
  2. Attach an IAM policy to the developer's IAM user or role that allows the `iam:PassRole` action on `DynamoDbReaderRole`.Answer
  3. C
    Attach an IAM policy to the developer's IAM user or role that allows the `sts:AssumeRole` action on `DynamoDbReaderRole`.
  4. D
    Modify the trust policy of `DynamoDbReaderRole` to allow the developer's IAM user ARN to perform the `sts:AssumeRole` action.
  5. E
    Embed the AWS access keys of an IAM user with full DynamoDB permissions directly into the Lambda function's environment variables and remove the role association.

Answer

To successfully deploy the Lambda function, the developer must modify the trust policy of the role to allow the Lambda service principal to assume it, and attach an IAM policy to their own user or role that grants permission to pass the role.
The correct configuration requires two actions. First, the trust policy of the execution role must trust the `lambda.amazonaws.com` service principal so that AWS Lambda can assume the role when running the function. Second, the developer's IAM identity must have permission to perform `iam:PassRole` on the execution role, which authorizes the developer to associate this specific role with the Lambda service during deployment.

Step-by-Step Solution

1
Analyze the two error messages: one related to the service not being authorized to assume the role, and the other related to the user not being authorized to perform `iam:PassRole`.
Identify that the Lambda service principal must be allowed to assume the role, and the developer's user identity must have permission to pass the role.
This isolates the two distinct IAM configurations required: the trust policy on the role and the permissions policy on the developer.
2
Configure the trust relationship for the execution role.
The trust policy of `DynamoDbReaderRole` is updated to allow `sts:AssumeRole` for `lambda.amazonaws.com`.
This allows the Lambda service to assume the execution role when invoking the function.
3
Grant the developer authorization to assign the role to the Lambda function.
An IAM policy with `iam:PassRole` on the role's ARN is attached to the developer's IAM user or group.
This allows the developer to pass the role to AWS Lambda during the creation or update of the function.

Key Concept

The combination of the service trust policy (which defines who can assume the role) and the `iam:PassRole` permission (which authorizes a user to pass the role to a service) is required for successful service role association.
Estimated Time:1m 30s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic