Examkin

Soru

Zorluk: OrtaAWS Serverless Application Model (SAM)

A developer is deploying a serverless application using AWS SAM. The template contains a custom IAM role and a Lambda function configured as follows:

yaml
Transform: AWS::Serverless-2016-10-31
Resources:
ProcessDataFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Role: !GetAtt CustomExecutionRole.Arn

CustomExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- apigateway.amazonaws.com
Action:
- sts:AssumeRole
Policies:
- PolicyName: DynamoDBWritePolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- dynamodb:PutItem
Resource: '*'

During deployment, the CloudFormation stack creation fails with an error indicating that the Lambda function could not be created because AWS Lambda was unable to assume the configured role.

Which configuration change will resolve this deployment failure?

  1. A
    Remove the Transform: AWS::Serverless-2016-10-31 line from the template, as this declaration prevents CloudFormation from deploying standard AWS::IAM::Role resources.
  2. B
    Modify the Lambda function's properties to use a custom integration rather than a proxy integration to allow the role context to pass through API Gateway.
  3. Modify the trust policy of CustomExecutionRole to specify lambda.amazonaws.com as the service principal in the Principal block.Cevap
  4. D
    Increase the Timeout property of the ProcessDataFunction to ensure the Lambda execution environment has enough time to assume the IAM role during container initialization.

Cevap

Modify the trust policy of the custom execution role to specify the Lambda service principal, allowing AWS Lambda to assume the execution role.
The trust policy of an IAM role determines which entities are trusted to assume the role. For a Lambda function execution role, the trust policy must explicitly allow the AWS Lambda service principal (lambda.amazonaws.com) to assume the role. Because the template erroneously trusts API Gateway (apigateway.amazonaws.com) instead, the Lambda service is unauthorized to assume the role during deployment, leading to a creation failure.

Adım Adım Çözüm

1
Identify the resource type and configuration in the AWS SAM template.
The template uses AWS::Serverless::Function and references a custom IAM execution role named CustomExecutionRole.
Understanding the relationship between the Lambda function and its execution role is necessary to trace role assumption issues.
2
Inspect the trust policy document configuration for the custom execution role.
The trust policy principal is set to apigateway.amazonaws.com instead of lambda.amazonaws.com.
The trust policy controls which AWS services are allowed to assume the role. If the wrong service principal is specified, the target service will be blocked from assuming the role.
3
Update the trust policy's principal to trust the Lambda service.
Changing the service principal to lambda.amazonaws.com permits the Lambda service to assume the role during initialization.
This resolves the deployment failure by granting AWS Lambda the required permissions to assume the configured role.

Anahtar Kavram

AWS SAM Lambda execution role configurations require a trust policy allowing lambda.amazonaws.com to assume the role.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS Serverless Application Model (SAM)

Bu konudan daha fazla soru