A SysOps administrator is configuring an Amazon EventBridge Scheduler schedule to invoke an AWS Lambda function on a recurring basis. The schedule must execute using a custom IAM service role named SchedulerExecutionRole that has permissions to invoke the Lambda function. When the administrator attempts to create the schedule, the operation fails with a permission error indicating that the schedule cannot be created. Which of the following actions must be taken to successfully create the schedule? (Select TWO.)
- Add a statement to the trust policy of the SchedulerExecutionRole to allow the scheduler.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
- Attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action on the SchedulerExecutionRole resource.Answer
- CAttach an IAM policy to the administrator's IAM user that allows the sts:AssumeRole action on the SchedulerExecutionRole resource.
- DAdd a statement to the trust policy of the SchedulerExecutionRole to allow the administrator's IAM user to perform the sts:AssumeRole action.
Answer
To resolve the permission issue, the trust policy of the SchedulerExecutionRole must be updated to allow the EventBridge Scheduler service principal (scheduler.amazonaws.com) to assume the role, and the SysOps administrator's IAM user must be granted the iam:PassRole permission to pass the role to the scheduler service.
To successfully configure Amazon EventBridge Scheduler to run using a custom execution role, two configuration conditions must be met: the scheduler service principal (scheduler.amazonaws.com) must have trust permissions to assume the role via its trust policy, and the deploying IAM identity must have the iam:PassRole permission to pass the role to the service.
Step-by-Step Solution
Key Concept
AWS Service Role Delegation and Trust Relationships