Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer is configuring an AWS Lambda function in AWS account 987654321098987654321098 to retrieve data from an Amazon S3 bucket. The function is assigned an IAM role named `LambdaS3ReaderRole`. The developer has already attached a permissions policy to this role that allows `s3:GetObject` on the target bucket. However, when the Lambda function runs, it fails with an authorization error indicating that the AWS Lambda service is not authorized to assume the role.

The developer inspects the trust policy of `LambdaS3ReaderRole` and finds the following configuration:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-app-data-bucket/*"
}
]
}

Which modification to the trust policy is required to resolve this error?

  1. A
    Change the Action element to "sts:AssumeRole" but keep the Resource element set to "arn:aws:s3:::my-app-data-bucket/*".
  2. B
    Change the Principal element to "AWS": "arn:aws:iam::987654321098:root" and add the Lambda function ARN to the Resource element.
  3. Change the Action element to "sts:AssumeRole" and remove the Resource element.Answer
  4. D
    Modify the Lambda function code to initialize the Amazon S3 client with the access key and secret access key of an IAM user that has S3 permissions, bypassing the role trust policy.

Answer

Change the Action element to "sts:AssumeRole" and remove the Resource element.
Changing the Action element to "sts:AssumeRole" and removing the Resource element is correct because an IAM role's trust policy governs who is trusted to assume the role. It must use the "sts:AssumeRole" action with the trusted service principal ("lambda.amazonaws.com") as the principal. The specific resource actions (such as "s3:GetObject") must be defined in the permissions policy attached to the role, not the trust policy.

Step-by-Step Solution

1
Analyze the error message and the current trust policy structure.
The Lambda service cannot assume the execution role because the trust policy's Action is set to "s3:GetObject" instead of a valid STS assume role action.
An IAM role's trust policy must specify an action that allows trust delegation (specifically "sts:AssumeRole" for AWS services).
2
Differentiate between the role's trust policy and its permissions policy.
The trust policy determines who can assume the role (the Lambda service principal), while the permissions policy determines what actions the assumed role can perform (S3 object retrieval).
Mixing permission actions like "s3:GetObject" and resource restrictions into the trust policy prevents the role from being assumed and violates the structural constraints of trust documents.
3
Correct the trust policy elements.
The Action element is updated to "sts:AssumeRole" and the Resource element is removed (since trust policies do not target external resources like S3 buckets).
This establishes the necessary trust link between the AWS Lambda service and the execution role, allowing execution to succeed.

Key Concept

Distinction between IAM Trust Policies and Permissions Policies
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic