Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is implementing an AWS Lambda function in Account A (123456789012123456789012) that needs to assume a specific IAM role named `TargetTaskRole` within the same account to perform administrative tasks. The Lambda function is configured with an execution role named `LambdaExecutionRole`.

The current trust policy of `TargetTaskRole` is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

During execution, the function code calls `sts:AssumeRole` for `TargetTaskRole` and fails with the following error:
`An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::123456789012:assumed-role/LambdaExecutionRole/my-function is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/TargetTaskRole`

Which of the following configurations are required to resolve this error? (Select TWO.)

  1. Add a permissions policy to the execution role `LambdaExecutionRole` that allows the `sts:AssumeRole` action on `arn:aws:iam::123456789012:role/TargetTaskRole`.Cevap
  2. Update the trust policy of `TargetTaskRole` to add the execution role ARN `arn:aws:iam::123456789012:role/LambdaExecutionRole` as a trusted principal.Cevap
  3. C
    Update the trust policy of `LambdaExecutionRole` to allow the `sts:AssumeRole` action on `arn:aws:iam::123456789012:role/TargetTaskRole`.
  4. D
    Modify the Lambda function code to initialize the AWS SDK client using static AWS access keys and secret keys generated for `TargetTaskRole`.
  5. E
    Configure the trust policy of `TargetTaskRole` to allow the AWS Security Token Service (`sts.amazonaws.com`) as a trusted principal.

Cevap

To resolve the AccessDenied error, the developer must grant the Lambda execution role permissions to assume the target role by adding an identity-based permissions policy, and configure the target role's trust policy to trust the Lambda execution role's ARN.
To assume an IAM role, permissions must be granted on both sides: the caller's permission policy must allow calling `sts:AssumeRole` on the target role, and the target role's trust policy must specify the caller's ARN as a trusted principal.

Adım Adım Çözüm

1
Add an identity-based permissions policy to the execution role.
The Lambda execution role has permission to invoke the `sts:AssumeRole` API on the target role resource.
By default, IAM roles do not have permissions to assume other roles.
2
Modify the target role's trust policy.
The target role trusts the execution role's ARN as a principal.
An IAM role can only be assumed by identities that are explicitly listed in its trust relationship policy.

Anahtar Kavram

IAM trust relationships and permission boundaries when assuming roles.
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru