Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is configuring an AWS Lambda function to process events from an Amazon S3 bucket. The developer creates an IAM role named S3ProcessorRole with the necessary permissions policy to read from the S3 bucket. However, when attempting to associate the role with the Lambda function, the developer receives the following error:

An error occurred (InvalidParameterValueException) when updating the function's configuration: KMS or signature validation failed or the provided execution role cannot be assumed by Lambda.

The current trust policy configured on the S3ProcessorRole is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following steps are required to resolve this error and enable the Lambda function to successfully read from the S3 bucket? (Select TWO.)

  1. Update the trust policy of S3ProcessorRole to specify "Service": "lambda.amazonaws.com" instead of "Service": "ec2.amazonaws.com".Cevap
  2. Attach an identity-based permissions policy to S3ProcessorRole that allows the s3:GetObject action on the target S3 bucket resource.Cevap
  3. C
    Add the sts:AssumeRole action to the identity-based permissions policy attached to S3ProcessorRole.
  4. D
    Add the s3:GetObject action directly to the trust policy of S3ProcessorRole under the Action list.
  5. E
    Configure the Lambda function to initialize the Amazon S3 client by passing hardcoded AWS access keys of an administrator IAM user.

Cevap

Update the trust policy of the IAM role to use the 'lambda.amazonaws.com' service principal and attach an identity-based permissions policy allowing 's3:GetObject' on the S3 bucket.
To resolve the error, the Lambda service must be allowed to assume the IAM role. This is done by specifying the Lambda service principal ('lambda.amazonaws.com') in the trust policy's Principal block. Additionally, to allow the Lambda function to read from the S3 bucket once the role is assumed, the role must have an identity-based permission policy that grants the 's3:GetObject' permission on the target S3 bucket.

Adım Adım Çözüm

1
Analyze the error message showing the execution role cannot be assumed by Lambda.
Determine that the Lambda service principal is missing from the trust policy.
An execution role requires a trust relationship that allows the service (Lambda) to assume it.
2
Update the trust policy of the S3ProcessorRole.
Modify the service principal to 'lambda.amazonaws.com' with the action 'sts:AssumeRole'.
This enables the Lambda service to assume the execution role when invoking the function.
3
Define the permissions required by the Lambda function code.
Attach an identity-based policy allowing 's3:GetObject' on the target S3 bucket resource.
Once assumed, the role needs permissions to perform the actual S3 read operation.

Anahtar Kavram

IAM trust policies vs permissions policies for service execution roles
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru