A developer is configuring an AWS Lambda function in Account A () to be triggered by an Amazon SQS queue named `IncomingQueue` in Account B (). The developer wants to establish this cross-account event source mapping under the principle of least privilege, without requiring the Lambda function to perform an explicit assume-role operation in its application code.
The developer has already attached the following permissions policy to the Lambda function's execution role, `LambdaQueueReaderRole`, in Account A:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Resource": "arn:aws:sqs:us-east-1:444455556666:IncomingQueue"
}
]
}
Which of the following configurations are also required to establish this cross-account trigger? (Select TWO.)
- Configure the resource-based policy of the SQS queue in Account B to allow the `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` actions for the principal `arn:aws:iam::111122223333:role/LambdaQueueReaderRole`.Cevap
- BConfigure the trust policy of `LambdaQueueReaderRole` in Account A to allow the SQS service principal (`sqs.amazonaws.com`) to perform the `sts:AssumeRole` action.
- Configure the trust policy of `LambdaQueueReaderRole` in Account A to allow the Lambda service principal (`lambda.amazonaws.com`) to perform the `sts:AssumeRole` action.Cevap
- DStore static AWS access keys for an IAM User created in Account B within the Lambda function's environment variables and initialize the SQS client with them.
- EModify the resource-based policy of the SQS queue in Account B to allow the `sts:AssumeRole` action for the `LambdaQueueReaderRole` principal.