A developer is setting up an AWS Lambda function that must read from an Amazon DynamoDB table. The developer creates an IAM role named AppStoreExecutionRole and attaches a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations. However, when invoking the Lambda function, it fails to execute with an authorization error because it cannot assume the role. The role's current trust policy is configured as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}
Which modification to the trust policy will resolve this authorization error?
- AAttach a permissions policy to the role that allows the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.
- Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.Cevap
- CUpdate the trust policy's Action block to allow lambda:InvokeFunction instead of sts:AssumeRole.
- DConfigure the Lambda function's application code to call the Security Token Service (STS) AssumeRole API using the AWS SDK during initialization.
Cevap
Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.
The correct answer is to update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal. AWS Lambda requires that any execution role assigned to a function trusts the Lambda service principal so that AWS Lambda can assume the role when invoking the function on the developer's behalf.
Adım Adım Çözüm
Anahtar Kavram
IAM trust policies define which principals (users, accounts, or services) are allowed to assume a role. For AWS services like Lambda to assume a role, the trust policy must explicitly grant the sts:AssumeRole action to the service's principal name (e.g., lambda.amazonaws.com).
Tahmini Süre:2m 0s