Examkin

Question

Difficulty: Very hardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator in Account A (111111111111111111111111) is configuring an Amazon EventBridge Scheduler schedule to invoke an AWS Lambda function in Account B (222222222222222222222222) on a daily basis.

The administrator creates an IAM role in Account A named `SchedulerExecutionRole` to be used as the execution role for the schedule. The role has a permissions policy that allows `lambda:InvokeFunction` on the target function `arn:aws:lambda:us-east-1:222222222222:function:DailyAudit`. The trust policy of `SchedulerExecutionRole` allows the `scheduler.amazonaws.com` service principal to assume the role.

When the administrator attempts to create the schedule using the AWS CLI, the command fails with an `AccessDeniedException` error, and the schedule is not created.

Which of the following configuration changes are required to successfully establish this workflow? (Select TWO.)

  1. Add an IAM policy statement to the administrator's IAM identity in Account A that grants the `iam:PassRole` permission for the `SchedulerExecutionRole` resource.Answer
  2. Configure the resource-based policy of the Lambda function in Account B to grant `lambda:InvokeFunction` permissions to the `SchedulerExecutionRole` principal.Answer
  3. C
    Add an IAM policy statement to the administrator's IAM identity in Account A that grants the `sts:AssumeRole` permission for the `SchedulerExecutionRole` resource.
  4. D
    Modify the trust policy of the `SchedulerExecutionRole` in Account A to trust the Lambda service principal `lambda.amazonaws.com` instead of the EventBridge Scheduler service principal.
  5. E
    Configure the trust policy of the Lambda function's execution role in Account B to trust the `SchedulerExecutionRole` from Account A.

Answer

To resolve the issue, the administrator's IAM identity in Account A must be granted the `iam:PassRole` permission for the `SchedulerExecutionRole` resource, and the resource-based policy of the Lambda function in Account B must grant `lambda:InvokeFunction` permissions to the `SchedulerExecutionRole` principal.
The correct answer configuration requires granting the administrator the `iam:PassRole` permission to authorize passing the execution role to the EventBridge Scheduler service, and updating the resource-based policy of the Lambda function in Account B to trust the execution role from Account A. The `AccessDeniedException` encountered during CLI execution indicates that the administrator lacks the `iam:PassRole` permission. Cross-account invocation of a Lambda function requires that the target function itself allows the caller principal via its resource-based policy, which must be configured in Account B.

Step-by-Step Solution

1
Analyze the access denied error encountered during the schedule creation process.
The administrator cannot associate the IAM execution role with the EventBridge Scheduler because the administrator lacks permission to pass the role.
AWS prevents privilege escalation by requiring users to have the `iam:PassRole` permission when configuring AWS services with execution roles.
2
Specify the required identity-based permission in Account A.
An IAM policy statement is added to the administrator's policy allowing `iam:PassRole` on the `SchedulerExecutionRole` ARN.
This grants the administrator the necessary privilege to pass the specific role to the EventBridge Scheduler service principal.
3
Analyze cross-account invocation requirements for AWS Lambda.
Even if the execution role has a permissions policy allowing `lambda:InvokeFunction` on the remote resource, cross-account calls must be explicitly authorized by the resource-owner account.
A resource-based policy on the target Lambda function in Account B must be updated to allow invocation by the execution role in Account A.

Key Concept

Successful cross-account invocation of target services by scheduled execution roles requires the administrator to possess `iam:PassRole` to delegate the role, and the target service in the receiving account to have a resource-based policy allowing invocation by the delegated role principal.
Estimated Time:3m 0s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic