Examkin

Soru

Zorluk: OrtaAWS Serverless Application Model (SAM)

A developer is writing an AWS SAM template for a serverless application. The application contains a Lambda function (`ProcessOrdersFunction`) that must execute with a custom IAM role to comply with strict organizational security requirements. The developer defines the custom role and the function in the SAM template as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
LambdaExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: apigateway.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: DynamoDBWriteAccess
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- dynamodb:PutItem
Resource: !GetAtt OrdersTable.Arn

ProcessOrdersFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: src/
Handler: index.handler
Runtime: nodejs18.x
Role: !GetAtt LambdaExecutionRole.Arn

OrdersTable:
Type: AWS::Serverless::SimpleTable

During deployment, the stack is created successfully. However, when the client application triggers the Lambda function, the function fails to execute, and the logs indicate that the execution role cannot be assumed. What is the root cause of this execution failure?

  1. A
    The template is missing the required AWS CloudFormation Transform declaration, which prevents AWS SAM from correctly compiling the custom IAM role.
  2. B
    The function does not define a custom execution timeout, causing AWS Lambda to reject the role assumption request.
  3. The trust policy on the custom role specifies the service principal for API Gateway (apigateway.amazonaws.com) rather than AWS Lambda (lambda.amazonaws.com).Cevap
  4. D
    The API Gateway Lambda Proxy integration requires the execution role's trust policy to authorize the API Gateway service instead of the Lambda service.

Cevap

The trust policy on the custom role incorrectly specifies the service principal for API Gateway rather than AWS Lambda, preventing AWS Lambda from assuming the execution role at runtime.
The correct answer is the option stating that the trust policy on the custom role specifies the service principal for API Gateway rather than AWS Lambda. For AWS Lambda to successfully execute a function, the function's execution role must contain a trust policy (AssumeRolePolicyDocument) that allows the AWS Lambda service principal ('lambda.amazonaws.com') to assume the role via the 'sts:AssumeRole' action. In this template, the service principal is set to 'apigateway.amazonaws.com', which prevents the Lambda service from assuming the role.

Adım Adım Çözüm

1
Analyze the error context and deployment logs.
The stack deployed successfully, meaning the template structure and SAM transforms are valid. However, a runtime error occurs stating that the execution role cannot be assumed.
This isolates the issue to IAM role trust relationships rather than template parsing or CloudFormation syntax errors.
2
Examine the configuration of the custom IAM role in the SAM template.
The AssumeRolePolicyDocument allows the principal 'apigateway.amazonaws.com' to call 'sts:AssumeRole'.
The trust policy defines which AWS service or identity is trusted to assume the role. AWS Lambda requires the role to trust its own service principal.
3
Identify the correct service principal for AWS Lambda.
The service principal must be changed to 'lambda.amazonaws.com'.
Without trusting 'lambda.amazonaws.com', the AWS Lambda service cannot assume the role to run the function code under that identity, causing a runtime execution failure.

Anahtar Kavram

AWS Lambda Execution Role Trust Policy Configuration
Bu soruyu puanla

Konular

AWS Serverless Application Model (SAM)

Bu konudan daha fazla soru