A developer is creating an AWS Lambda function that must write logs to Amazon CloudWatch Logs and read objects from an Amazon S3 bucket. The developer creates an IAM role with the necessary permissions policy attached. However, when the developer tries to create the Lambda function and associate it with this IAM role, the operation fails with an authorization error. The developer reviews the trust policy currently associated with the IAM role:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Which action will resolve this issue and allow the Lambda function to run with the required permissions?
- AModify the trust policy of the IAM role to change the Action element from sts:AssumeRole to cloudwatch:PutLogEvents and s3:GetObject.
- Modify the trust policy of the IAM role to change the service principal in the Principal block to lambda.amazonaws.com.Cevap
- CAdd the lambda:InvokeFunction permission directly to the Action element of the trust policy, and specify the Lambda function's ARN in the Principal block.
- DInitialize the AWS SDK clients inside the Lambda function code by passing the AWS access key ID and secret access key of an IAM admin user.
Cevap
Modify the trust policy of the IAM role to change the service principal in the Principal block to lambda.amazonaws.com.
The trust policy of an IAM role defines which security principal (in this case, an AWS service) is allowed to assume the role using the Security Token Service (STS). For an AWS Lambda function to assume the role, the service principal must be set to 'lambda.amazonaws.com'. Changing the principal from 'ec2.amazonaws.com' to 'lambda.amazonaws.com' resolves the authorization failure.
Adım Adım Çözüm
Anahtar Kavram
IAM Trust Policies define which entities (such as AWS services) are allowed to assume an IAM role. A permissions policy defines what actions the assumed role can perform.