A developer has configured an AWS Lambda function in Account A () to retrieve configuration files from a secured Amazon S3 bucket in the same account. The developer created an IAM role named `LambdaS3ReaderRole` with the following trust policy and permissions policy, and assigned it as the function's execution role:
Trust Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Permissions Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::app-config-bucket-1111/*"
}
]
}
During local testing, the developer used their own IAM user access keys, which had administrative privileges. Before deploying to the Lambda environment, the developer committed the following code:
python
import boto3
import os
def lambda_handler(event, context):
# Initialize the S3 client
s3_client = boto3.client(
's3',
aws_access_key_id=os.environ.get('AWS_ACCESS_KEY_ID', 'AKIAIOSFODNN7EXAMPLE'),
aws_secret_access_key=os.environ.get('AWS_SECRET_ACCESS_KEY', 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY')
)
try:
response = s3_client.get_object(
Bucket='app-config-bucket-1111',
Key='settings.json'
)
return response['Body'].read().decode('utf-8')
except Exception as e:
print(f"Error: {str(e)}")
raise e
After deploying the Lambda function, the execution fails with an `AccessDenied` error when trying to retrieve the S3 object. The developer verifies that the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are not set in the Lambda function's configuration.
Which of the following options explains the cause of this authorization failure, and describes the correct way to resolve it?
- The SDK client is initialized with the fallback dummy credentials because the environment variables are not set. This explicit credential initialization bypasses the default credential provider chain, preventing the Lambda function from using the temporary security credentials provided by its execution role. To resolve this, initialize the client using `boto3.client('s3')` without passing explicit credentials.Cevap
- BThe trust policy on `LambdaS3ReaderRole` is misconfigured because it designates the Lambda service principal (`lambda.amazonaws.com`) as the trusted entity instead of the Amazon S3 service principal (`s3.amazonaws.com`). To resolve this, update the trust policy's principal to trust the Amazon S3 service so that the role can access S3 buckets.
- CThe Lambda function requires the execution role's temporary access keys to be manually passed. To resolve this, configure the Lambda function's environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` by referencing the `LambdaS3ReaderRole` credentials in the Lambda function settings.
- DThe permissions policy attached to `LambdaS3ReaderRole` is missing the `sts:AssumeRole` action. To resolve this, add a statement to the permissions policy that explicitly allows the role to perform `sts:AssumeRole` on itself, which is required for the function to generate the temporary credentials needed for S3 access.