Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is using an IAM user account to deploy an AWS Lambda function that processes messages from an Amazon SQS queue. The administrator has already created a custom IAM execution role named LambdaSQSProcessorRole with all necessary permissions for the function. However, when the administrator attempts to create the Lambda function and associate it with this role, the operation fails with an AccessDenied error. Which of the following actions will resolve this issue?

  1. A
    Modify the trust policy of the LambdaSQSProcessorRole to allow the administrator's IAM user to perform the sts:AssumeRole action.
  2. B
    Attach an IAM policy to the administrator's IAM user that allows the sts:AssumeRole action on the LambdaSQSProcessorRole resource.
  3. Attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action on the LambdaSQSProcessorRole resource.Answer
  4. D
    Modify the permissions boundary of the LambdaSQSProcessorRole to include the sts:AssumeRole action for the administrator's IAM user.

Answer

Attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action on the LambdaSQSProcessorRole resource.
The correct action is to attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action. In AWS, when an IAM user or role configures a service to run under a specific execution role, they must have the iam:PassRole permission on that target role resource. Without this, the service cannot receive the role, resulting in an AccessDenied error.

Step-by-Step Solution

1
Analyze the error context.
The SysOps administrator's IAM user is attempting to pass a service execution role (LambdaSQSProcessorRole) to the AWS Lambda service during function creation, but encounters an AccessDenied error.
When configuring an AWS service to run with a specific role, the configuration identity must have permission to pass that role to the service.
2
Identify the required IAM action.
The action required is 'iam:PassRole' on the specific role ARN.
This permission ensures that only authorized users can assign high-privilege roles to AWS services.
3
Select the correct option.
The correct action is to attach a policy to the administrator's IAM user allowing 'iam:PassRole' on the 'LambdaSQSProcessorRole' resource.
This directly resolves the AccessDenied error by granting the required permission to the administrator's user identity.

Key Concept

IAM PassRole Permission
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic