Security

390 questions

All types390 Multiple choice195 Multiple select195

A company is building a multi-tenant REST API using Amazon API Gateway. The API must validate incoming calls from clients using a custom JSON Web Token (JWT) sent in the X-Custom-Auth header. The token validation requires checking the token's signature against a public key, verifying that the tenant_id claim matches a list of active tenants, and dynamically generating an IAM policy to restrict access to only the tenant's specific resources. The authorization decision needs to be cached for 300 seconds to optimize performance. Which solution should a developer implement to meet these requirements?

Create a Lambda authorizer of type REQUEST. Configure method.request.header.X-Custom-Auth as the identity source. In the Lambda function, validate the JWT, extract the tenant_id claim, construct an IAM policy targeting the tenant's specific resource path, and return the policy.

Configure an Amazon Cognito User Pool authorizer. Set the token source header to X-Custom-Auth. Configure a Cognito post-authentication Lambda trigger to validate the JWT signature, extract the tenant_id claim, and dynamically generate the required IAM policy for API Gateway.

Configure a Cognito Identity Pool to authenticate clients using the custom JWT. Enable AWS_IAM authorization on the API Gateway methods. Instruct clients to exchange their JWT for temporary AWS credentials and sign their API Gateway requests using Signature Version 4 (SigV4).

Configure a Lambda Proxy integration to pass the X-Custom-Auth header directly to the backend Lambda function. In the backend Lambda function, validate the JWT, extract the tenant_id claim, and use the AWS Security Token Service (STS) to dynamically apply the generated IAM policy to the current execution context.

Show answer & explanation

Answer: Create a Lambda authorizer of type REQUEST. Configure method.request.header.X-Custom-Auth as the identity source. In the Lambda function, validate the JWT, extract the tenant_id claim, construct an IAM policy targeting the tenant's specific resource path, and return the policy.

Answer

The correct solution uses a REQUEST-type Lambda authorizer. By defining the identity source as `method.request.header.X-Custom-Auth`, API Gateway can cache the generated IAM policy for 300 seconds. The Lambda authorizer executes code to validate the third-party JWT, check the tenant_id claim, and return a custom IAM policy that limits access to only the tenant's specific API paths, complying with least-privilege security principles.

Step-by-Step Solution

Determine the appropriate authorization mechanism.

Since custom JWT verification, claim validation (tenant_id), and dynamic IAM policy generation are required, a built-in Cognito User Pool authorizer cannot be used. A Lambda authorizer is required.

Only Lambda authorizers allow running custom code to validate third-party tokens and output dynamically generated IAM policies.

Select the Lambda authorizer type and identity source.

Use a REQUEST-type Lambda authorizer with `method.request.header.X-Custom-Auth` configured as the identity source.

A REQUEST authorizer provides access to request headers, query parameters, and stage variables. Defining the header as the identity source allows API Gateway to cache the authorization policy for the specified 300-second TTL.

Implement validation and least-privilege IAM policy generation in the Lambda function.

The Lambda function verifies the signature of the token from X-Custom-Auth, decodes the payload, validates the tenant_id claim, and returns an IAM policy allowing access only to `arn:aws:execute-api:region:account-id:api-id/stage/method/tenant-resource/*`.

This guarantees security boundaries between tenants and adheres to the IAM principle of least privilege.

Key Concept

API Gateway Lambda Authorizer with Token Caching and Scoped IAM Policies

Question 142Question →

A developer is building a REST API using Amazon API Gateway and wants to restrict access to authenticated users from a specific Amazon Cognito User Pool. The developer wants to use the built-in integration features of API Gateway without writing custom code for authentication validation. Which two actions must the developer perform to configure a Cognito User Pools authorizer for the API? (Select two.)

Select all that apply

Create a Cognito User Pool authorizer in API Gateway and configure it with the Cognito User Pool details.

Configure the API Gateway resource method to use the newly created Cognito User Pool authorizer.

Create a Cognito Identity Pool authorizer in API Gateway and configure it with the Identity Pool ID.

Create a custom Lambda authorizer that manually decodes and verifies the Cognito User Pool identity tokens.

Configure a Lambda integration in proxy mode so that the backend function handles Cognito client verification.

Show answer & explanation

Answer: Create a Cognito User Pool authorizer in API Gateway and configure it with the Cognito User Pool details.; Configure the API Gateway resource method to use the newly created Cognito User Pool authorizer.

Answer

To configure a Cognito User Pools authorizer, the developer must create the Cognito User Pool authorizer in API Gateway and then configure the API method to use that authorizer.

To secure the API using Cognito User Pools natively, the developer needs to create a Cognito User Pool authorizer in API Gateway and then assign that authorizer to the respective resource methods. This offloads authentication from backend integrations to API Gateway.

Step-by-Step Solution

Set up the authorizer in API Gateway.

A Cognito User Pool authorizer is created and pointed to the appropriate User Pool.

This establishes the validation source for the incoming JWT tokens without requiring custom code.

Associate the authorizer with the API resource method.

The target HTTP method on the resource is configured to require authentication via the new authorizer.

This ensures that API Gateway blocks unauthorized requests before they reach the backend integration.

Key Concept

API Gateway Cognito User Pools Authorizer

Estimated Time:1m 0s

Question 143Question →

A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to securely download external libraries from a public repository on the internet and retrieve configuration parameters from AWS Systems Manager Parameter Store. Which of the following VPC configurations are required to meet these requirements? (Select TWO.)

Select all that apply

Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet.

Create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) and associate it with the private subnets.

Deploy the Lambda function directly in a public subnet with an attached Internet Gateway to allow direct outbound internet access.

Store the registry access credentials in AWS Systems Manager Parameter Store and enable native automatic secret rotation.

Modify the IAM trust policy of the Lambda execution role to allow the Systems Manager service principal (ssm.amazonaws.com) to assume the role.

Show answer & explanation

Answer: Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet.; Create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) and associate it with the private subnets.

Answer

Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet, and create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) associated with the private subnets.

The correct configurations involve routing private subnet outbound internet traffic to a NAT Gateway in a public subnet, and establishing an Interface VPC Endpoint for Systems Manager. This allows the Lambda function to securely communicate with both the public internet and AWS Systems Manager privately.

Step-by-Step Solution

Analyze internet access requirements for Lambda in a private subnet.

To access the public internet (external registry), a Lambda function in a private subnet requires a route targeting a NAT Gateway located in a public subnet.

Resources in private subnets cannot associate with public IP addresses directly, so egress to the internet must be handled by a Network Translation (NAT) device.

Analyze private access to AWS Systems Manager.

Create an Interface VPC Endpoint (PrivateLink) for 'ssm' and map it to the private subnets.

This establishes a secure, private connection to Systems Manager within the VPC without routing traffic through the public internet.

Key Concept

VPC Egress and VPC Endpoints for Lambda

Question 144Question →

A company is deploying an application on Amazon EC2 instances located in a private subnet of a custom VPC. The application must securely retrieve database credentials from AWS Secrets Manager and also connect to a public API endpoint of an external partner over the internet.

Which of the following network configurations must the developer implement to meet these requirements while minimizing data transfer over the public internet? (Select TWO.)

Select all that apply

Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet.

Deploy a NAT gateway in a public subnet and add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT gateway.

Create a gateway VPC endpoint for AWS Secrets Manager and associate it with the private subnet's route table.

Store the database credentials in Systems Manager Parameter Store and configure a gateway VPC endpoint to retrieve them, as Parameter Store supports automatic credential rotation.

Update the trust policy of the EC2 instance's IAM role to allow assume-role actions from the Secrets Manager service endpoint.

Show answer & explanation

Answer: Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet.; Deploy a NAT gateway in a public subnet and add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT gateway.

Answer

The correct configurations are to create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet, and deploy a NAT gateway in a public subnet with a route in the private subnet's route table pointing outbound internet-bound traffic (0.0.0.0/0) to the NAT gateway.

To satisfy both requirements under the constraint of minimizing public internet usage, the developer must: 1. Deploy an Interface VPC Endpoint (PrivateLink) for Secrets Manager so that credential requests remain entirely within the AWS network. 2. Use a NAT Gateway in a public subnet coupled with a route in the private route table to enable outbound internet access to the external payment API.

Step-by-Step Solution

Determine the required connectivity for AWS Secrets Manager.

Since the goal is to retrieve credentials securely while minimizing internet traffic, the application should connect to Secrets Manager privately. Secrets Manager supports Interface VPC Endpoints (AWS PrivateLink) for private network connectivity.

Using an interface endpoint prevents database credential retrieval traffic from traversing the public internet.

Determine the required connectivity for the external API.

The external API is a public internet endpoint. Instances in private subnets cannot access the public internet directly. A NAT gateway must be deployed in a public subnet, and a route to it (for 0.0.0.0/0) must be added to the private subnet's route table.

A NAT gateway allows private subnet resources to initiate outbound requests to public endpoints.

Key Concept

Configuring private subnets to securely access AWS services via VPC endpoints and external services via NAT Gateways.

Question 145Question →

A developer is building an application that needs to encrypt files locally before uploading them to Amazon S3. Each file is approximately $150\text{ MB}$ in size. The encryption process must use client-side envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS, minimizing network overhead and API requests. Which two actions must the developer perform to complete this client-side encryption process?

Select all that apply

Call the KMS GenerateDataKey API passing the Customer Managed Key ID to retrieve a plaintext data key and a ciphertext data key.

Encrypt the file locally using the plaintext data key, store the ciphertext data key alongside the encrypted file in Amazon S3, and delete the plaintext data key from memory.

Call the KMS Encrypt API directly with the file payload to encrypt the entire file before transmitting it.

Call the KMS GenerateDataKeyWithoutPlaintext API and use the returned ciphertext data key to encrypt the files locally.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString, and retrieve it for each file upload.

Show answer & explanation

Answer: Call the KMS GenerateDataKey API passing the Customer Managed Key ID to retrieve a plaintext data key and a ciphertext data key.; Encrypt the file locally using the plaintext data key, store the ciphertext data key alongside the encrypted file in Amazon S3, and delete the plaintext data key from memory.

Answer

To perform client-side envelope encryption, the developer must call the KMS GenerateDataKey API to obtain a plaintext and ciphertext data key, use the plaintext data key to encrypt the file locally, store the ciphertext data key alongside the encrypted file, and destroy the plaintext data key from memory.

The correct options describe the standard client-side envelope encryption workflow. The developer calls the GenerateDataKey API to obtain both a plaintext data key and a ciphertext data key. The plaintext key is used to encrypt the

150\text{ MB}

file locally, after which the plaintext key is discarded from memory. The ciphertext data key is stored alongside the encrypted file in S3 so that it can be decrypted later by calling the KMS Decrypt API.

Step-by-Step Solution

Generate a unique data key using AWS KMS.

The application receives a plaintext data key and a ciphertext data key encrypted by the KMS Customer Managed Key.

This is the initial step of the envelope encryption pattern, allowing the local system to obtain the keying material needed for bulk encryption without sending the actual file payload to KMS.

Encrypt the file locally using the plaintext data key.

The

150\text{ MB}

file is converted into ciphertext.

This allows the high-throughput encryption of large payloads to occur locally, avoiding KMS size limitations (such as the

4\text{ KB}

limit on the Encrypt API) and reducing network overhead.

Upload the encrypted file and the ciphertext data key to Amazon S3, and clean up memory.

The encrypted payload and ciphertext key are stored in S3, and the plaintext data key is purged from application memory.

Ensures that the plaintext key is not exposed or stored persistently, while the ciphertext key remains available for future decryption operations.

Key Concept

AWS KMS Envelope Encryption Workflow for Large Payloads

Estimated Time:1m 30s

Question 146Question →

An application deployed on AWS Lambda in Account A ( $111122223333$ ) needs to retrieve and decrypt S3 objects from an Amazon S3 bucket located in Account B ( $444455556666$ ). The S3 bucket is configured with Server-Side Encryption (SSE-KMS) using a KMS customer managed key.

Which two AWS KMS configuration steps are required to enable the Lambda function to decrypt the objects? (Select TWO.)

Select all that apply

In Account B, modify the KMS customer managed key's key policy to grant the Lambda execution role in Account A permission to perform the kms:Decrypt action.

In Account A, attach an IAM policy to the Lambda execution role that grants the kms:Decrypt permission on the ARN of the customer managed key in Account B.

In Account B, configure the S3 bucket policy to grant kms:Decrypt permissions to the Lambda execution role from Account A.

Configure the S3 bucket in Account B to use the default AWS managed key aws/s3 for encryption and grant the Lambda execution role kms:Decrypt permission on that key.

In Account A, store the KMS key's plaintext backing key in Systems Manager Parameter Store as a SecureString parameter and grant the Lambda execution role read access.

Show answer & explanation

Answer: In Account B, modify the KMS customer managed key's key policy to grant the Lambda execution role in Account A permission to perform the kms:Decrypt action.; In Account A, attach an IAM policy to the Lambda execution role that grants the kms:Decrypt permission on the ARN of the customer managed key in Account B.

Answer

The Lambda function execution role requires permissions in both accounts: a KMS key policy update in Account B to allow the role to perform the kms:Decrypt operation, and an IAM policy in Account A allowing the role to call the kms:Decrypt action on the key's ARN in Account B.

For cross-account access to KMS keys, permissions must be granted by both the resource owner (Account B) and the consumer (Account A). First, the KMS customer managed key's policy in Account B must be modified to trust and allow the Lambda execution role ARN from Account A to perform the decryption operation. Second, the Lambda execution role in Account A must have an IAM policy attached that permits it to perform the decryption action against the KMS key ARN in Account B.

Step-by-Step Solution

Examine the cross-account requirements for SSE-KMS decryption.

Identify that both S3 access and KMS key access are required, and that KMS cross-account access requires permissions in both the key policy (trusting account) and the IAM policy (trusted account).

KMS evaluates authorization in both the caller's account and the resource-owning account for cross-account requests.

Configure the key-owning account (Account B).

Modify the customer managed key's key policy in Account B to grant kms:Decrypt permissions to the specific Lambda execution role ARN in Account A.

This establishes trust from the resource owner to the external identity.

Configure the caller's account (Account A).

Attach an IAM policy to the Lambda execution role in Account A granting kms:Decrypt on the specific customer managed key ARN from Account B.

This grants the identity the authority to call KMS across accounts.

Key Concept

Cross-account KMS authorization requires permission grants in both the KMS key policy (resource-based) and the caller's IAM policy (identity-based), and AWS managed keys do not support cross-account sharing.

Question 147Question →

A developer is deploying a backend microservice on an AWS Lambda function that is configured to run inside the private subnets of a custom VPC. The function must retrieve database credentials from AWS Secrets Manager and query an Amazon DynamoDB table. Due to strict compliance guidelines, the VPC has no Internet Gateway or NAT Gateway attached, and all traffic must remain within the AWS network.

Which two configuration steps should the developer perform to establish private connectivity to these services while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets.

Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure its security group to allow inbound HTTPS traffic from the security group associated with the Lambda function.

Configure the Lambda function's security group to allow outbound traffic to 0.0.0.0/0, and rely on the default VPC route table to route traffic to the public endpoints of Secrets Manager and DynamoDB.

Create a Gateway VPC Endpoint for AWS Secrets Manager, and store the credentials in Systems Manager Parameter Store as Standard String parameters.

Modify the trust policy of the Lambda function's execution role to allow secretsmanager.amazonaws.com and dynamodb.amazonaws.com to assume the role, enabling direct network access.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets.; Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure its security group to allow inbound HTTPS traffic from the security group associated with the Lambda function.

Answer

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets with its security group configured to allow inbound HTTPS traffic from the security group associated with the Lambda function.

To connect to AWS services privately from a VPC without internet access, developers must use VPC endpoints. Amazon DynamoDB supports Gateway VPC Endpoints, which route traffic directly to the service using route table entries associated with the private subnets. AWS Secrets Manager requires an Interface VPC Endpoint, which deploys Elastic Network Interfaces (ENIs) into the subnets. To secure access to the Secrets Manager Interface Endpoint under the principle of least privilege, its security group must allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.

Step-by-Step Solution

Determine the correct VPC endpoint type for Amazon DynamoDB.

Identify that DynamoDB supports Gateway VPC Endpoints.

Gateway endpoints provide private routing to DynamoDB via subnet route tables without incurring hourly charges or requiring security group modifications.

Determine the correct VPC endpoint type for AWS Secrets Manager.

Identify that Secrets Manager requires an Interface VPC Endpoint (AWS PrivateLink).

Secrets Manager does not support Gateway endpoints; it requires an Interface endpoint, which places an Elastic Network Interface (ENI) with a private IP in the subnets.

Configure the security group for the Secrets Manager Interface VPC Endpoint.

Allow inbound HTTPS (TCP port 443) traffic originating from the specific security group assigned to the Lambda function.

This implements the principle of least privilege, ensuring only the authorized Lambda function can reach the Secrets Manager interface.

Key Concept

VPC Endpoint Routing and Security Group Configuration for Private AWS Service Access

Estimated Time:2m 0s

Question 148Question →

A developer is building a REST API in Amazon API Gateway. The API needs to validate JSON Web Tokens (JWTs) sent by clients who have authenticated using an Amazon Cognito User Pool. The developer wants to implement this security check with the least configuration effort and no additional custom code. Which authorization method is the most appropriate to meet these requirements?

Configure an API Gateway Cognito User Pool authorizer by specifying the User Pool ID and client ID.

Create a custom Lambda authorizer that imports a JWT library to verify and decode the token signature.

Set up an Amazon Cognito Identity Pool to authenticate the requests and grant temporary IAM credentials to the API clients.

Use a Lambda proxy integration to forward the raw request headers and perform the token validation inside the backend Lambda function logic.

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool authorizer by specifying the User Pool ID and client ID.

Answer

Configure an API Gateway Cognito User Pool authorizer by specifying the User Pool ID and client ID.

The correct option is configuring an API Gateway Cognito User Pool authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) generated by Cognito User Pools, eliminating the need to write, test, or pay for custom Lambda authorizer code.

Step-by-Step Solution

Identify the authorization requirements.

The API must validate JWTs generated specifically by an Amazon Cognito User Pool.

Knowing the token source helps determine if a native, built-in solution is available.

Evaluate native API Gateway features for Amazon Cognito.

Amazon API Gateway offers a built-in Cognito User Pool authorizer specifically designed to validate these JWT tokens without writing code.

This minimizes administrative overhead, custom code maintenance, and execution cost.

Select the option that requires the least configuration and coding effort.

Configuring the native Cognito User Pool authorizer meets all requirements with the lowest effort.

Other methods either require custom Lambda code or confuse User Pools with Identity Pools.

Key Concept

API Gateway Cognito User Pools Authorizer

Question 149Question →

A developer is building a web application that allows users to sign in using Amazon Cognito. The backend REST API is hosted on Amazon API Gateway. The developer needs to secure the API so that only authenticated users can access the resources. The solution must minimize code maintenance, overhead, and latency. Which configuration should the developer implement to meet these requirements?

Create a custom Lambda authorizer that validates the Amazon Cognito JSON Web Token (JWT) by fetching the public JSON Web Key Set (JWKS) from the user pool.

Configure an Amazon Cognito User Pool authorizer on the API Gateway methods and pass the Cognito identity token in the request header.

Integrate an Amazon Cognito Identity Pool with API Gateway using IAM authorization, and sign all incoming client requests using Signature Version 4.

Configure a Lambda proxy integration on the API methods and implement custom token validation logic inside the backend Lambda function.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool authorizer on the API Gateway methods and pass the Cognito identity token in the request header.

Answer

Configure an Amazon Cognito User Pool authorizer on the API Gateway methods and pass the Cognito identity token in the request header.

Configuring an Amazon Cognito User Pool authorizer allows API Gateway to automatically validate the incoming identity token without requiring custom Lambda code. This minimizes latency, development effort, and execution costs compared to custom authorizers.

Step-by-Step Solution

Analyze the requirements for securing the API Gateway REST API.

The requirement specifies validating user credentials from Amazon Cognito with minimal code maintenance, overhead, and latency.

This helps narrow down the choices between built-in API Gateway features and custom authorization code.

Compare built-in API Gateway features with custom-coded solutions.

Amazon API Gateway offers a built-in Amazon Cognito User Pool authorizer that validates JWT tokens natively without invoking any custom Lambda functions.

Using native features reduces both execution latency and the overhead of maintaining custom code.

Evaluate and eliminate incorrect authorization configurations.

Custom Lambda authorizers add custom code; Cognito Identity Pools (IAM auth) require request signing and are designed for AWS resource authorization; validating tokens inside a Lambda proxy integration mixes authentication with backend business logic and incurs extra runtime costs.

This identifies the built-in Cognito User Pool authorizer as the most efficient and standard solution.

Key Concept

API Gateway built-in Cognito User Pool Authorizers provide native, low-latency validation of JSON Web Tokens (JWT) without writing or managing custom backend code.

Estimated Time:1m 30s

Question 150Question →

A developer is writing a script to encrypt a small configuration string of size $500\text{ B}$ before storing it in a database. The developer wants to use AWS KMS to perform the encryption directly on the AWS side, avoiding the complexity of local envelope encryption. Which AWS KMS API operation should the developer call to encrypt this data?

Encrypt

GenerateDataKey

ReEncrypt

GetSecretValue

Show answer & explanation

Answer: Encrypt

Answer

The Encrypt operation should be called because it directly encrypts small payloads (up to

4\text{ KB}

) using the KMS key on the AWS side.

The correct answer is the direct encryption operation because the payload is small (

500\text{ B}

), which is below the

4\text{ KB}

limit for direct KMS encryption, allowing the developer to encrypt it without the overhead of client-side envelope encryption.

Step-by-Step Solution

Determine the size of the payload to be encrypted.

The payload size is

500\text{ B}

, which is well under the maximum limit of

4\text{ KB}

for direct KMS encryption.

AWS KMS direct encryption via the Encrypt API has a payload limit of

4\text{ KB}

Identify the encryption approach requested.

Direct encryption on the AWS KMS side is required, avoiding local client-side envelope encryption.

Direct encryption means we do not need to generate a data key locally; we send the plaintext directly to KMS.

Select the API operation that matches these criteria.

The Encrypt API operation matches both the size limitation and the requirement for direct KMS-side encryption.

Calling Encrypt returns the encrypted ciphertext directly from AWS KMS.

Key Concept

Direct encryption using AWS KMS is limited to payloads of up to

4\text{ KB}

, whereas larger payloads require client-side envelope encryption using generated data keys.

Question 151Question →

A telemetry data analysis company is building a REST API using Amazon API Gateway. The API will be consumed by two distinct groups:

1. Internal microservices running on Amazon EC2 instances that need to invoke the API securely using their IAM roles.
2. External customer applications that authenticate against an external identity provider and send a custom JSON Web Token (JWT) containing dynamic billing tier claims.

The developer needs to configure the security and authorization for this API in a way that minimizes custom code for standard authentication, supports fine-grained billing-tier checks, and ensures minimum latency.

Which two configuration steps should the developer perform to meet these requirements?

Select all that apply

Configure AWS_IAM authorization on the API resources accessed by the internal microservices, and grant the EC2 instance profile roles the execute-api:Invoke permission.

Create an API Gateway Lambda authorizer of type REQUEST to validate the custom JWT and enforce authorization based on the dynamic billing tier claims.

Configure an Amazon Cognito Identity Pool to directly authorize the external custom JWTs at the API Gateway method request level.

Configure a built-in Amazon Cognito User Pool authorizer to validate and decode the external custom JWTs containing the dynamic billing tier claims.

Configure the API method to use a Lambda Proxy integration to inspect the billing tier claims and return a 403 Forbidden status code if unauthorized.

Show answer & explanation

Answer: Configure AWS_IAM authorization on the API resources accessed by the internal microservices, and grant the EC2 instance profile roles the execute-api:Invoke permission.; Create an API Gateway Lambda authorizer of type REQUEST to validate the custom JWT and enforce authorization based on the dynamic billing tier claims.

Answer

Configure AWS_IAM authorization on the API resources accessed by the internal microservices with execute-api:Invoke permissions, and create an API Gateway Lambda authorizer of type REQUEST to validate the custom JWT and enforce billing tier claims.

The correct configuration requires utilizing AWS_IAM authorization for callers that possess IAM credentials (the internal microservices), and implementing a custom Lambda authorizer of type REQUEST to handle external clients sending custom JWTs with proprietary billing claims. This setup ensures that API Gateway offloads standard authentication natively and handles complex claims verification securely before hitting backend integrations.

Step-by-Step Solution

Evaluate the authentication requirements for the internal microservices.

Since internal microservices on Amazon EC2 have IAM roles, using AWS_IAM authorization is the native choice requiring no custom authentication code.

AWS_IAM authorization allows API Gateway to natively leverage IAM policies and signature verification, minimizing latency and code overhead.

Evaluate authorization mechanisms for custom third-party JWTs.

Built-in Cognito authorizers cannot process custom external tokens directly. A custom Lambda authorizer must be used.

Lambda authorizers execute custom validation logic, which is required to parse proprietary JWTs and evaluate claims such as billing tiers.

Select the correct Lambda authorizer structure.

A REQUEST-type Lambda authorizer receives headers, query strings, and stage variables to execute verification.

A REQUEST authorizer provides flexibility to validate the authorization header and use caching to optimize latency for subsequent API requests.

Key Concept

API Gateway Authorizers and IAM Access Control

Question 152Question →

A backend service must encrypt large archives of user data locally before uploading them to a third-party storage provider. The developer needs to implement envelope encryption using a customer managed key in AWS KMS. The service needs to obtain a data key that can be used to encrypt the archives immediately and then be discarded from memory.

Which AWS KMS API operation should the developer invoke to retrieve the required data key?

Encrypt

GenerateDataKey

GenerateDataKeyWithoutPlaintext

Decrypt

Show answer & explanation

Answer: GenerateDataKey

Answer

GenerateDataKey

The correct answer is the operation GenerateDataKey. In envelope encryption, the application needs to encrypt data locally. It calls the GenerateDataKey API, which returns a plaintext data key and an encrypted data key. The application uses the plaintext data key to encrypt the data, discards the plaintext key from memory, and stores the encrypted data key alongside the encrypted data.

Step-by-Step Solution

Determine the type of encryption required.

Envelope encryption is required because the application needs to encrypt large archives locally before upload.

Direct KMS encryption via the Encrypt API is limited to

4\text{ KB}

payloads, so client-side envelope encryption must be used for larger files.

Identify the state of the data key needed.

The application needs the plaintext data key to perform the encryption immediately, and the encrypted data key to store alongside the ciphertext.

Encryption requires a plaintext key, but for security, the plaintext key is discarded after use and only the encrypted key is saved for future decryption.

Select the correct KMS API operation.

GenerateDataKey is selected.

GenerateDataKey returns both the plaintext and ciphertext versions of the data key, satisfying the requirement to encrypt immediately. GenerateDataKeyWithoutPlaintext only returns the ciphertext version.

Key Concept

KMS Envelope Encryption API operations

Estimated Time:1m 30s

Question 153Question →

A developer is securing a REST API in Amazon API Gateway. Users authenticate against an Amazon Cognito User Pool. The developer wants API Gateway to automatically validate the incoming JSON Web Tokens (JWT) before forwarding requests to the backend, with the least operational overhead.

Which two steps must the developer perform to configure this security setup? (Select TWO.)

Select all that apply

Create a Cognito User Pool authorizer in API Gateway and configure it with the user pool details.

Configure the API Gateway method authorization to use the newly created Cognito User Pool authorizer.

Create a Cognito Identity Pool to issue temporary IAM credentials for signing requests using Signature Version 4.

Create a custom Lambda authorizer to manually decode and validate the signature of the Cognito JSON Web Token.

Configure a Lambda custom integration mapping template to parse authorization headers and validate JWT signatures.

Show answer & explanation

Answer: Create a Cognito User Pool authorizer in API Gateway and configure it with the user pool details.; Configure the API Gateway method authorization to use the newly created Cognito User Pool authorizer.

Answer

Create a Cognito User Pool authorizer in API Gateway and configure the API Gateway method authorization to use it.

The correct options represent the standard path for native JWT validation with Cognito. Creating a Cognito User Pool authorizer leverages built-in functionality to automatically validate signatures, expiration, and audience of identity tokens. Configuring the API Gateway method to use this authorizer ensures the validation checks are applied to incoming requests.

Step-by-Step Solution

Identify the authentication source and authorization requirements.

The source is a Cognito User Pool, and token validation must happen at API Gateway with minimal custom code.

This determines that API Gateway's built-in Cognito User Pool authorizer is the optimal choice.

Configure the authorizer in the API Gateway console or via IaC.

A Cognito User Pool authorizer is created and pointed to the correct Cognito User Pool.

This establishes the validation connection between API Gateway and the user pool.

Enable authorization on the specific API resources and methods.

The method authorization settings are updated to point to the Cognito User Pool authorizer.

This enforces validation on incoming requests before they reach the backend Lambda functions.

Key Concept

API Gateway Cognito User Pool Authorizers

Question 154Question →

A developer needs to encrypt a database backup file of size $2\text{ GB}$ on an application server before uploading it to Amazon S3. The developer decides to use client-side envelope encryption with an AWS KMS customer managed key.

Which two actions must the developer perform to encrypt the file locally?

Select all that apply

Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted data key.

Encrypt the file locally with the plaintext data key, and then securely discard the plaintext key from memory.

Call the KMS Encrypt API operation directly to encrypt the entire

2\text{ GB}

file.

Call the GenerateDataKeyWithoutPlaintext API operation to get the encrypted key, and then decrypt it using an SSL certificate.

Store the database backup file directly in Systems Manager Parameter Store to automatically encrypt it with a secure string parameter.

Show answer & explanation

Answer: Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted data key.; Encrypt the file locally with the plaintext data key, and then securely discard the plaintext key from memory.

Answer

The developer must call the GenerateDataKey API to obtain the data keys, encrypt the file locally with the plaintext data key, and then securely remove the plaintext data key from memory.

To perform envelope encryption, the application calls the GenerateDataKey API, which returns a plaintext data key and an encrypted version of that same key. The developer uses the plaintext data key to encrypt the large file locally. Once encrypted, the plaintext data key is discarded from memory, and the encrypted data key is stored alongside the ciphertext file so it can be decrypted later.

Step-by-Step Solution

Generate data keys using KMS API

Obtained a plaintext data key and an encrypted data key

KMS cannot encrypt payloads larger than

4\text{ KB}

directly, so a local data key is required for envelope encryption.

Encrypt the database backup file locally

The file is encrypted using the plaintext data key

This performs the actual cryptographic operation on the large file locally.

Discard the plaintext data key from memory

The plaintext data key is removed from the application's memory

To ensure security, the plaintext data key should not persist in memory after use.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 155Question →

A developer is implementing client-side envelope encryption for a microservice that processes sensitive payload objects larger than $128\text{ KB}$ before storing them in an Amazon DynamoDB table. The developer needs to minimize latency, avoid KMS cryptographic limits, and ensure secure key storage.

Which of the following workflows is the correct method to encrypt and store the payloads?

Call `Encrypt` using the Customer Managed Key (CMK) to encrypt each payload directly, and then call `GenerateDataKeyWithoutPlaintext` to generate a secondary local data key to encrypt the metadata before storing both payloads in DynamoDB.

Call `GenerateDataKey` using the Customer Managed Key (CMK) to obtain a plaintext data key and a ciphertext data key. Encrypt the payload locally using the plaintext data key, immediately delete the plaintext data key from memory, and store the ciphertext data key alongside the encrypted payload in DynamoDB.

Call `GenerateDataKey` to obtain a data key, encrypt the payload locally, and store the plaintext data key as a secure configuration in Systems Manager Parameter Store with automatic rotation enabled to decrypt future payloads.

Call `GenerateDataKey` using the Customer Managed Key (CMK) to get the plaintext key, encrypt the payload, and then update the IAM Trust Policy of the microservice's execution role to allow the DynamoDB service principal to decrypt the data key directly.

Show answer & explanation

Answer: Call `GenerateDataKey` using the Customer Managed Key (CMK) to obtain a plaintext data key and a ciphertext data key. Encrypt the payload locally using the plaintext data key, immediately delete the plaintext data key from memory, and store the ciphertext data key alongside the encrypted payload in DynamoDB.

Answer

Call the `GenerateDataKey` API to obtain a plaintext and ciphertext data key, encrypt the payload locally, delete the plaintext key from memory, and store the ciphertext data key with the encrypted payload in DynamoDB.

The correct workflow for client-side envelope encryption involves calling the `GenerateDataKey` API to obtain both a plaintext and a ciphertext version of a unique data key. The plaintext key is used to perform the resource-intensive encryption locally, keeping payload transit off the network and avoiding KMS API rate limits or payload size limits. The plaintext key is then deleted from memory, and the encrypted (ciphertext) data key is stored alongside the encrypted data.

Step-by-Step Solution

Request a data key from AWS KMS.

The `GenerateDataKey` API is called with the Customer Managed Key, returning both a plaintext data key and an encrypted (ciphertext) data key.

This provides a unique data key for symmetric encryption of the payload, ensuring envelope encryption constraints are met.

Encrypt the sensitive payload client-side.

The plaintext data key is used with a local cryptographic library (e.g., AES-GCM) to encrypt the payload larger than

128\text{ KB}

without sending the payload to AWS KMS.

AWS KMS direct encryption APIs (`Encrypt`) have a limit of

4\text{ KB}

, so client-side encryption is required for larger payloads to prevent payload limit failures.

Persist the encrypted data and data key, cleaning up memory.

The plaintext data key is wiped from memory, and the encrypted payload along with the ciphertext data key are saved into DynamoDB.

This ensures the plaintext key is not exposed and that future decryption is possible by calling `Decrypt` with the ciphertext data key.

Key Concept

AWS KMS Envelope Encryption

Estimated Time:2m 30s

Question 156Question →

A developer is building a mobile application that allows external users to authenticate using an external OpenID Connect (OIDC) identity provider. Once authenticated, users must be able to upload log files directly to a private Amazon S3 bucket. Each user's uploads must be restricted to an S3 folder named after their unique OIDC user identifier (the `sub` claim). The application also needs to write metadata for each upload to an Amazon DynamoDB table, using the same OIDC `sub` value as the partition key. Which solution meets these requirements with the least development effort and adheres to the principle of least privilege?

Configure an Amazon Cognito User Pool with the OIDC provider. Configure an Amazon Cognito Identity Pool using the User Pool as an authentication provider. In the authenticated IAM role, define the S3 prefix and DynamoDB partition key using the policy variable `${cognito-identity.amazonaws.com:sub}`.

Create an Amazon API Gateway endpoint with a custom Lambda Authorizer. Have the Lambda Authorizer validate the OIDC token, retrieve the `sub` claim, and call `sts:AssumeRole` to generate temporary AWS credentials with an inline IAM policy scoped to the user's OIDC `sub` prefix. Pass these credentials back to the client to perform S3 and DynamoDB operations.

Configure an Amazon Cognito User Pool with the OIDC provider as an identity provider, mapping the OIDC `sub` claim to a custom attribute. Configure an Amazon Cognito Identity Pool with the User Pool as an authentication provider, enabling 'Attributes for access control' to map the custom attribute to a principal tag. Reference the mapped tag using `${aws:PrincipalTag/...}` in the IAM policy for the authenticated role to authorize S3 and DynamoDB actions.

Federate the OIDC provider directly with an Amazon Cognito Identity Pool. Associate an IAM role with the Identity Pool, and reference `${amazon.cognito.auth.externalIdp:sub}` in the IAM policy to restrict S3 bucket and DynamoDB access.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with the OIDC provider as an identity provider, mapping the OIDC `sub` claim to a custom attribute. Configure an Amazon Cognito Identity Pool with the User Pool as an authentication provider, enabling 'Attributes for access control' to map the custom attribute to a principal tag. Reference the mapped tag using `${aws:PrincipalTag/...}` in the IAM policy for the authenticated role to authorize S3 and DynamoDB actions.

Answer

The correct solution is to configure the Amazon Cognito User Pool to map the OIDC `sub` claim to a custom attribute, map that attribute to a principal tag in the Identity Pool using 'Attributes for access control', and reference the tag via the policy variable in the IAM policy.

Mapping the OIDC `sub` claim to a Cognito User Pool custom attribute, exposing it as a Principal Tag via the Identity Pool's 'Attributes for access control', and utilizing the principal tag policy variable in the IAM policy is the most secure and operationally efficient way to implement attribute-based access control (ABAC) for federated users.

Step-by-Step Solution

Map the OIDC provider's unique `sub` claim to a custom attribute (e.g., `custom:oidc_sub`) in the Amazon Cognito User Pool during authentication setup.

The external provider's unique user identifier is captured and persisted in the Cognito user directory.

This makes the claim available for downstream mapping within AWS credentials session generation.

Enable 'Attributes for access control' in the Amazon Cognito Identity Pool and configure a mapping from the custom User Pool attribute `custom:oidc_sub` to a principal tag (e.g., `user_id`).

The identity provider claim is converted into a session tag (`aws:PrincipalTag/user_id`) attached to the temporary credentials issued by AWS STS.

This enables Attribute-Based Access Control (ABAC) dynamically on AWS services using IAM policy variables.

Create an IAM policy for the Cognito authenticated role that restricts S3 access to `arn:aws:s3:::my-bucket/

{aws:PrincipalTag/user_id}/*` and DynamoDB access based on the leading key matching `

{aws:PrincipalTag/user_id}`.

Dynamic, fine-grained access control is enforced automatically for each unique user based on their federated OIDC session identifier.

This adheres to the principle of least privilege without creating separate IAM roles per user or writing token exchange logic.

Key Concept

Attribute-Based Access Control (ABAC) with Amazon Cognito Identity Pools and federated OIDC providers.

Question 157Question →

A company is developing a REST API in Amazon API Gateway that will serve a partner dashboard. The dashboard authenticates users through a third-party OpenID Connect (OIDC) identity provider. The developer needs to secure the API Gateway endpoints so that only users containing the PartnerAdmin role within their OIDC token can access the /partner/settings resource. To optimize performance and reduce backend overhead, the system must cache the authorization decisions for up to 10 minutes. Which two configuration steps should the developer perform to meet these requirements?

Select all that apply

Create an API Gateway Lambda authorizer that validates the OIDC JSON Web Token (JWT), verifies the presence of the PartnerAdmin role within the claims, and returns an IAM policy allowing execute-api:Invoke on the resource ARN.

Enable authorizer caching in the API Gateway authorizer configuration, set the TTL to 600 seconds, and specify the client's identity source header as the cache key.

Create an Amazon Cognito User Pool authorizer in API Gateway, configure the Issuer URI to match the third-party OIDC provider, and filter incoming requests using a custom gateway policy mapping.

Configure the API Gateway resource to use standard IAM authorization, and implement token validation and role-checking logic directly within the backend Lambda proxy integration function.

Create an Amazon Cognito Identity Pool authorizer in API Gateway, link the third-party OIDC identity provider, and configure the authorizer to validate the JWT.

Show answer & explanation

Answer: Create an API Gateway Lambda authorizer that validates the OIDC JSON Web Token (JWT), verifies the presence of the PartnerAdmin role within the claims, and returns an IAM policy allowing execute-api:Invoke on the resource ARN.; Enable authorizer caching in the API Gateway authorizer configuration, set the TTL to 600 seconds, and specify the client's identity source header as the cache key.

Answer

Create an API Gateway Lambda authorizer that validates the OIDC JWT token and returns an IAM policy allowing access to the resource, and enable authorizer caching with a TTL of 600 seconds utilizing the identity source header as the cache key.

The correct configurations involve creating a Lambda authorizer to decode and validate the third-party OIDC JWT token, verify the custom claims, and return an IAM policy allowing access. To meet the performance requirement, authorizer caching must be configured on the authorizer with a 600-second TTL using the identity source header (such as the Authorization header) as the cache key.

Step-by-Step Solution

Determine the token issuer and auth type

Identify that the token is issued by a third-party OIDC provider, which rules out Amazon Cognito User Pool authorizers since they only natively support Cognito User Pools.

Choosing the correct authorizer type is the first step to securing custom integrations.

Configure a Lambda authorizer

Create a Lambda authorizer that parses the JWT token, extracts the claims (specifically looking for the PartnerAdmin role), and returns an IAM policy allowing execute-api:Invoke on the target resource.

A Lambda authorizer is required to evaluate custom JWT claims and generate policy documents dynamically.

Configure caching in API Gateway

Enable authorizer caching with a TTL of 600 seconds, setting the identity source to the HTTP header containing the token (e.g., Authorization).

Caching avoids calling the Lambda authorizer on every incoming request, which minimizes overhead and latency.

Key Concept

API Gateway custom Lambda authorizers are used for validating third-party JWT tokens and dynamic policy generation, and authorization caching is used to decrease cost and latency.

Question 158Question →

An application needs to decrypt locally stored database backups that were encrypted using client-side envelope encryption with an AWS Key Management Service (AWS KMS) Customer Managed Key (CMK). The application has access to the encrypted database backups and the encrypted data key that was packaged with the backup. Which two actions must the developer perform in the application code to decrypt the database backups?

Select all that apply

Call the KMS Decrypt API passing the encrypted data key to retrieve the plaintext data key.

Decrypt the database backup locally using the retrieved plaintext data key and a symmetric encryption algorithm.

Call the KMS GenerateDataKey API to recreate the original plaintext data key.

Call the KMS Decrypt API passing the entire database backup payload directly to KMS to decrypt it.

Retrieve the plaintext data key from Systems Manager Parameter Store where it was automatically stored during the encryption process.

Show answer & explanation

Answer: Call the KMS Decrypt API passing the encrypted data key to retrieve the plaintext data key.; Decrypt the database backup locally using the retrieved plaintext data key and a symmetric encryption algorithm.

Answer

Call the KMS Decrypt API passing the encrypted data key to retrieve the plaintext data key, and decrypt the database backup locally using the retrieved plaintext data key and a symmetric encryption algorithm.

In envelope encryption, data is encrypted locally using a unique symmetric data key, and the data key itself is encrypted using a KMS Customer Managed Key. To decrypt the data, the application must send the encrypted data key to the KMS Decrypt API to obtain the plaintext data key. After receiving the plaintext key, the application uses it locally to decrypt the large backup file using a symmetric algorithm such as AES.

Step-by-Step Solution

Pass the encrypted data key to the KMS Decrypt API.

The API returns the decrypted plaintext version of the data key.

The data key is encrypted under a KMS key and must be decrypted by KMS before it can be used for decryption.

Use the plaintext data key with a local encryption library.

The database backup ciphertext is decrypted back into its original plaintext format.

Large data is decrypted client-side using symmetric cryptography (envelope encryption) to avoid sending large files over the network to KMS.

Key Concept

AWS KMS Envelope Decryption Workflow

Question 159Question →

A logistics company is developing a cargo tracking application. The mobile client authenticates users via an Amazon Cognito User Pool. The client application needs to invoke a REST API hosted on Amazon API Gateway to fetch real-time tracking data. The developer wants to restrict access to this API endpoint to ensure that only users authenticated by the user pool can access it. Which approach should the developer use to meet these requirements with the lowest latency and minimal operational overhead?

Configure an Amazon Cognito User Pool authorizer on the API Gateway method, and specify the client's identity or access token in the authorization header.

Configure an Amazon Cognito Identity Pool authorizer on the API Gateway method, and specify the identity pool ID in the HTTP headers of the request.

Create a custom AWS Lambda authorizer that validates the token signature using the Cognito User Pool public keys and generates an IAM policy for the request.

Configure a Lambda proxy integration on the API Gateway method to pass the raw request to the backend function, then validate the token within the function's application code.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool authorizer on the API Gateway method, and specify the client's identity or access token in the authorization header.

Answer

Configure an Amazon Cognito User Pool authorizer on the API Gateway method, and specify the client's identity or access token in the authorization header.

Integrating Amazon API Gateway with an Amazon Cognito User Pool using a built-in Cognito User Pool authorizer allows API Gateway to natively validate the JSON Web Tokens (JWTs) sent by the client. This approach does not require writing or maintaining custom code, runs with minimal latency, and incurs no additional cost or execution time associated with Lambda custom authorizers.

Step-by-Step Solution

Identify the authentication provider and the required integration.

The authentication provider is an Amazon Cognito User Pool which issues JSON Web Tokens (JWTs).

Understanding the source of the user identity is key to selecting the correct authorizer type.

Evaluate the native API Gateway features for JWT validation.

API Gateway offers a built-in Cognito User Pool authorizer that validates JWTs automatically.

Using native features minimizes operational overhead (no code to write) and provides lower latency than custom code execution.

Compare alternatives against the latency and overhead constraints.

Custom Lambda authorizers add latency/cost, Cognito Identity Pools are for resource authorization rather than API authentication, and backend validation runs billing charges for rejected requests.

Verifying constraints ensures the selected native authorizer is the optimal path.

Key Concept

Amazon API Gateway Cognito User Pool Authorizer

Estimated Time:1m 30s

Question 160Question →

A developer is implementing a cross-account ingestion pipeline where an AWS Lambda function running in Account A ( $111111111111$ ) needs to write files to an Amazon S3 bucket in Account B ( $222222222222$ ). The Lambda function is configured with the execution role `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

To write files, the Lambda function code uses the AWS SDK to assume an IAM role in Account B named `S3WriteRole` (`arn:aws:iam::222222222222:role/S3WriteRole`).

The IAM policy attached to `LambdaExecutionRole` in Account A is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::222222222222:role/S3WriteRole"
}
]
}

When the Lambda function executes, the `sts:AssumeRole` API call fails with an `AccessDenied` error. The developer inspects the trust policy of `S3WriteRole` in Account B, which is currently configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following modifications to Account B's `S3WriteRole` trust policy will resolve this authorization error?

Keep the Service principal as lambda.amazonaws.com and add a Condition block matching the aws:PrincipalArn to arn:aws:iam::111111111111:role/LambdaExecutionRole.

Update the Action element in the trust policy to include both sts:AssumeRole and s3:PutObject, and set the Resource to the S3 bucket ARN.

Change the Principal element in the trust policy to trust the AWS resource ARN: "AWS": "arn:aws:iam::111111111111:role/LambdaExecutionRole".

Hardcode the access keys of an IAM user in Account B who has write access to the S3 bucket directly into the Lambda function code, bypassing the STS call.

Show answer & explanation

Answer: Change the Principal element in the trust policy to trust the AWS resource ARN: "AWS": "arn:aws:iam::111111111111:role/LambdaExecutionRole".

Answer

Change the Principal element in the trust policy to trust the AWS resource ARN: "AWS": "arn:aws:iam::111111111111:role/LambdaExecutionRole".

The correct answer changes the trust policy's principal to trust the AWS principal of the execution role. This is correct because when the Lambda function runs and makes an SDK call to assume the role, it uses the credentials of its execution role. The target role's trust policy in Account B must explicitly trust this execution role ARN.

Step-by-Step Solution

Analyze the IAM caller context of the Lambda execution environment.

The AWS SDK inside the Lambda function uses the function's execution role (`LambdaExecutionRole`) to sign the request to assume the target role.

Understanding which principal initiates the API request is key to setting up the trust relationship.

Determine the required trust policy principal type.

Since the request is made by an IAM role (an AWS principal) and not by the Lambda service itself, the trust policy must use the "AWS" principal type pointing to the role's ARN.

Service principals are only used when AWS services (like Lambda or EC2) directly assume a role to bootstrap an execution environment, not for programmatic calls.

Validate the cross-account role assumption handshake.

Account A's role has permission to perform `sts:AssumeRole` on Account B's role, and Account B's role trusts Account A's role. This completes the trust chain.

Both sides of the cross-account relationship must be explicitly configured for the action to succeed.

Key Concept

AWS IAM trust relationships require configuring the correct principal type (AWS principal vs Service principal) depending on who is performing the role assumption.

Estimated Time:3m 0s

PreviousPage 8 / 20Next

Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept