A developer is setting up an Amazon S3 Batch Operations job to execute an AWS Lambda function on millions of objects in an Amazon S3 bucket. The developer creates an IAM role to grant the necessary permissions. However, the S3 Batch Operations job fails to run during initialization, resulting in an authorization failure. The developer inspects the trust policy attached to the role:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Which two actions should the developer take to resolve this authorization failure and successfully run the batch job? (Select TWO.)
- Update the service principal in the trust policy to batchoperations.s3.amazonaws.comCevap
- Attach a permissions policy to the IAM role that allows the lambda:InvokeFunction action on the target Lambda function's ARNCevap
- CChange the Action in the trust policy from sts:AssumeRole to lambda:InvokeFunction to allow direct execution of the function
- DConfigure the Lambda function code to manually call sts:AssumeRole to retrieve temporary credentials for the S3 Batch Operations service
- EAttach a resource-based policy to the S3 bucket that allows the sts:AssumeRole action for the s3.amazonaws.com principal
Cevap
Update the service principal in the trust policy to batchoperations.s3.amazonaws.com and attach a permissions policy to the IAM role that allows the lambda:InvokeFunction action on the target Lambda function's ARN.
To fix the authorization error, the trust policy must explicitly allow the S3 Batch Operations service to assume the role. The correct service principal is batchoperations.s3.amazonaws.com. Additionally, the role needs a permissions policy attached to it that permits the lambda:InvokeFunction action on the specific Lambda function being run.
Adım Adım Çözüm
Anahtar Kavram
Separation of Trust Policies and Permissions Policies