Soru

Zorluk: OrtaIAM Policies and Roles

A developer is setting up an Amazon S3 Batch Operations job to execute an AWS Lambda function on millions of objects in an Amazon S3 bucket. The developer creates an IAM role to grant the necessary permissions. However, the S3 Batch Operations job fails to run during initialization, resulting in an authorization failure. The developer inspects the trust policy attached to the role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which two actions should the developer take to resolve this authorization failure and successfully run the batch job? (Select TWO.)

  1. Update the service principal in the trust policy to batchoperations.s3.amazonaws.comCevap
  2. Attach a permissions policy to the IAM role that allows the lambda:InvokeFunction action on the target Lambda function's ARNCevap
  3. C
    Change the Action in the trust policy from sts:AssumeRole to lambda:InvokeFunction to allow direct execution of the function
  4. D
    Configure the Lambda function code to manually call sts:AssumeRole to retrieve temporary credentials for the S3 Batch Operations service
  5. E
    Attach a resource-based policy to the S3 bucket that allows the sts:AssumeRole action for the s3.amazonaws.com principal

Cevap

Update the service principal in the trust policy to batchoperations.s3.amazonaws.com and attach a permissions policy to the IAM role that allows the lambda:InvokeFunction action on the target Lambda function's ARN.
To fix the authorization error, the trust policy must explicitly allow the S3 Batch Operations service to assume the role. The correct service principal is batchoperations.s3.amazonaws.com. Additionally, the role needs a permissions policy attached to it that permits the lambda:InvokeFunction action on the specific Lambda function being run.

Adım Adım Çözüm

1
Identify the service attempting to assume the IAM role.
The service is S3 Batch Operations, which uses the specific service principal batchoperations.s3.amazonaws.com.
The standard s3.amazonaws.com principal is used for basic features like replication and event notifications, but not for batch operations.
2
Modify the trust policy principal accordingly.
The trust policy allows batchoperations.s3.amazonaws.com to perform sts:AssumeRole.
This establishes trust between the S3 Batch Operations service and the IAM role.
3
Determine the necessary operational permissions.
The role requires permission to run the Lambda function, which corresponds to the lambda:InvokeFunction action.
Trust policies only control delegation; standard IAM permissions policies must be attached to the role to authorize downstream actions.

Anahtar Kavram

Separation of Trust Policies and Permissions Policies
Bu soruyu puanla