A developer is deploying an AWS Lambda function that reads incoming user data from an Amazon Kinesis data stream. The developer creates an IAM role with a permissions policy allowing the necessary Kinesis read actions. However, the Lambda function fails to retrieve data, and the logs indicate that the Lambda service is unauthorized to assume the configured execution role.
The trust policy attached to the IAM role is shown below:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "kinesis.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
How should the developer resolve this issue to allow the Lambda function to execute and read from the stream?
- AAdd the kinesis:DescribeStream and kinesis:GetRecords permissions directly into the Action array of the trust policy.
- BInitialize the AWS SDK client inside the Lambda function code by passing the AWS access key and secret access key associated with the IAM role.
- Change the service principal in the trust policy to "lambda.amazonaws.com" to allow the Lambda service to assume the execution role.Cevap
- DChange the Action in the trust policy from sts:AssumeRole to kinesis:AssumeRole to align with the service principal configuration.
Cevap
Change the service principal in the trust policy to "lambda.amazonaws.com" to allow the Lambda service to assume the execution role.
To resolve the assumption failure, the trust policy of the execution role must specify lambda.amazonaws.com as the trusted service principal. This grants the AWS Lambda service the permission to assume the role and perform actions on behalf of the function.
Adım Adım Çözüm
Anahtar Kavram
IAM trust policies define which entities (accounts, users, or AWS services) are trusted to assume an IAM role, while IAM permissions policies define what actions the assumed role can perform.