Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

An AWS Lambda function in Account A (111111111111111111111111) uses its execution role, `LambdaExecutionRole`, to retrieve parameters from AWS Systems Manager Parameter Store in Account B (222222222222222222222222). To perform this task, the function's code executes an AWS STS `AssumeRole` API call targeting an IAM role in Account B named `ParameterReaderRole`. Although `LambdaExecutionRole` is granted permissions to perform `sts:AssumeRole` on the target resource, the invocation fails with an `AccessDenied` error. The trust policy for `ParameterReaderRole` is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

How should the developer modify the trust policy of `ParameterReaderRole` to resolve this issue?

  1. A
    Attach a resource-based policy directly to the Systems Manager Parameter Store parameters in Account B to allow access from the Lambda execution role in Account A.
  2. B
    Modify the Lambda function code to use the AWS SDK to authenticate using a hardcoded AWS access key and secret access key associated with an IAM user in Account B.
  3. Change the Principal block in the trust policy of ParameterReaderRole to reference the Lambda function's execution role ARN: "AWS": "arn:aws:iam::111111111111:role/LambdaExecutionRole".Cevap
  4. D
    Modify the trust policy of ParameterReaderRole to specify the Systems Manager service principal "Service": "ssm.amazonaws.com" as the allowed principal.

Cevap

Change the Principal block in the trust policy of ParameterReaderRole to reference the Lambda function's execution role ARN: "AWS": "arn:aws:iam::111111111111:role/LambdaExecutionRole".
The correct answer is the option proposing to change the Principal block to reference the Lambda function's execution role ARN. When a Lambda function runs code that calls `sts:AssumeRole`, the identity making the request is the function's execution role. Therefore, the trust policy of the target role in Account B must explicitly specify that execution role as a trusted principal to allow the cross-account role assumption to succeed.

Adım Adım Çözüm

1
Identify the caller initiating the sts:AssumeRole API call.
The caller is the Lambda function running under the credentials of its execution role: arn:aws:iam::111111111111:role/LambdaExecutionRole.
When a Lambda function executes code to assume a role, the execution role is the IAM identity that performs the action.
2
Analyze the existing trust policy of the destination IAM role (ParameterReaderRole) in Account B.
The trust policy currently trusts the service principal 'lambda.amazonaws.com'.
This configuration allows the Lambda service itself to assume the role (e.g., as a function execution role), but does not trust the execution role of a specific function in another account.
3
Modify the trust policy principal to match the caller.
The principal block is updated to trust the ARN of the Lambda execution role in Account A.
To establish a cross-account trust relationship, the trust policy in the target account must explicitly list the trusted IAM entity (the execution role) from the source account as the principal.

Anahtar Kavram

Cross-Account IAM Role Assumption and Trust Policies
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru