Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is configuring an AWS Lambda function in AWS Account A (111111111111) that needs to read objects from an Amazon S3 bucket in AWS Account B (222222222222) by assuming an IAM role named CrossAccountS3Reader in Account B. The Lambda function is assigned an execution role in Account A named LambdaExecutionRole. However, when the Lambda function attempts to assume the CrossAccountS3Reader role using AWS STS, the API call fails with an AccessDenied error. Which of the following configurations are required to resolve this issue? (Select TWO.)

  1. In Account A, attach an IAM policy to the LambdaExecutionRole that allows the sts:AssumeRole action on the ARN of the CrossAccountS3Reader role in Account B.Cevap
  2. In Account B, update the trust policy of the CrossAccountS3Reader role to allow the ARN of the LambdaExecutionRole from Account A to perform the sts:AssumeRole action.Cevap
  3. C
    In Account B, update the trust policy of the CrossAccountS3Reader role to specify lambda.amazonaws.com as the trusted service principal allowed to perform the sts:AssumeRole action.
  4. D
    In Account A, configure a resource-based policy on the Lambda function that allows Account B to call the lambda:InvokeFunction action.
  5. E
    In Account A, initialize the Amazon S3 client in the Lambda function by hardcoding temporary credentials generated from Account B.

Cevap

In Account A, attach an IAM policy to the LambdaExecutionRole that allows the sts:AssumeRole action on the ARN of the CrossAccountS3Reader role in Account B, and in Account B, update the trust policy of the CrossAccountS3Reader role to allow the ARN of the LambdaExecutionRole from Account A to perform the sts:AssumeRole action.
For cross-account role assumption using AWS STS, two configurations are required: first, the identity-based policy of the caller (the Lambda execution role in Account A) must grant permission to perform sts:AssumeRole on the target role; second, the trust policy of the target role in Account B must trust the caller's role ARN.

Adım Adım Çözüm

1
Configure the calling principal's permissions in Account A.
Attached an identity-based IAM policy to the LambdaExecutionRole allowing sts:AssumeRole targeting the ARN of the CrossAccountS3Reader role.
The entity attempting to assume a role must have explicit permission to perform the assume-role operation.
2
Configure the target role's trust relationship in Account B.
Updated the CrossAccountS3Reader role's trust policy to include the LambdaExecutionRole ARN as a trusted principal.
The destination role must trust the specific calling identity from the external account to successfully complete the sts:AssumeRole API call.

Anahtar Kavram

Cross-account IAM role delegation using AWS STS
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru