Soru

Zorluk: OrtaIAM Policies and Roles

A developer is configuring an AWS Lambda function in Account A (111122223333111122223333) to be triggered by an Amazon SQS queue named `IncomingQueue` in Account B (444455556666444455556666). The developer wants to establish this cross-account event source mapping under the principle of least privilege, without requiring the Lambda function to perform an explicit assume-role operation in its application code.

The developer has already attached the following permissions policy to the Lambda function's execution role, `LambdaQueueReaderRole`, in Account A:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Resource": "arn:aws:sqs:us-east-1:444455556666:IncomingQueue"
}
]
}

Which of the following configurations are also required to establish this cross-account trigger? (Select TWO.)

  1. Configure the resource-based policy of the SQS queue in Account B to allow the `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` actions for the principal `arn:aws:iam::111122223333:role/LambdaQueueReaderRole`.Cevap
  2. B
    Configure the trust policy of `LambdaQueueReaderRole` in Account A to allow the SQS service principal (`sqs.amazonaws.com`) to perform the `sts:AssumeRole` action.
  3. Configure the trust policy of `LambdaQueueReaderRole` in Account A to allow the Lambda service principal (`lambda.amazonaws.com`) to perform the `sts:AssumeRole` action.Cevap
  4. D
    Store static AWS access keys for an IAM User created in Account B within the Lambda function's environment variables and initialize the SQS client with them.
  5. E
    Modify the resource-based policy of the SQS queue in Account B to allow the `sts:AssumeRole` action for the `LambdaQueueReaderRole` principal.

Cevap

Configure the resource-based policy of the SQS queue in Account B to grant access to the Lambda execution role, and configure the trust policy of the Lambda execution role in Account A to allow the Lambda service principal to assume the role.
For cross-account SQS integration to work with AWS Lambda, the Lambda execution role in Account A must have the necessary IAM permissions to call SQS APIs, and its trust policy must allow `lambda.amazonaws.com` to assume it. Additionally, since the queue resides in Account B, the SQS queue's resource policy must permit the Lambda execution role ARN from Account A to execute the required consumer actions.

Adım Adım Çözüm

1
Verify Lambda Execution Role Trust Policy
The trust policy of the execution role in Account A must trust the service principal `lambda.amazonaws.com` so that the Lambda service has permission to assume the role.
Without this trust relationship, AWS Lambda cannot assume the execution role to poll the queue or invoke the function.
2
Configure the Cross-Account Resource Policy
Update the SQS queue policy in Account B to allow the Lambda execution role's ARN in Account A to perform the `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` actions.
For cross-account access to SQS, both the identity-based policy in the source account and the resource-based policy in the destination account must explicitly allow the actions.

Anahtar Kavram

Cross-account SQS integration requires both an identity-based policy in the source account and a resource-based policy in the destination account, alongside a properly configured trust relationship for the executing service principal.
Tahmini Süre:2m 0s
Bu soruyu puanla