IAM Policies and Roles

A developer is implementing an AWS Lambda function in Account A ($111111111111$) that needs to retrieve database credentials stored as a secure parameter in the Systems Manager Parameter Store in Account B ($222222222222$). The parameter is encrypted using an AWS KMS customer managed key (CMK) in Account B. The developer intends to use the AWS Security Token Service (STS) to assume an IAM role named `DbConfigReaderRole` in Account B.

The Lambda function is associated with an execution role named `LambdaExecutionRole` in Account A.

Which of the following configuration steps must be performed to allow the Lambda function to retrieve the configuration parameter? (Select TWO.)

A developer is deploying a containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The application needs to retrieve data from an Amazon DynamoDB table. The developer creates an IAM role named AppDynamoDBRole with a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations, and configures the task definition's taskRoleArn parameter to point to this role. The trust policy for AppDynamoDBRole is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the containerized application runs, it fails to authenticate with DynamoDB, and the container logs show an authorization error when attempting to assume the task role. Which of the following modifications to the configuration will resolve this issue?

A developer is configuring an AWS Lambda function in Account A ($111122223333$) to write data to an Amazon DynamoDB table in Account B ($444455556666$) by assuming an IAM role named `CrossAccountDynamoDBRole` in Account B. The Lambda function's execution role in Account A is named `LambdaExecutionRole`.

When the Lambda function invokes the `AssumeRole` API call using the AWS SDK, the execution fails with the following error:
`User: arn:aws:sts::111122223333:assumed-role/LambdaExecutionRole/my-function is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole`

Which TWO configurations must the developer implement to resolve this error?

A developer is deploying an application on an Amazon EC2 instance. The application is configured to read configuration templates from an Amazon S3 bucket. The developer creates an IAM role named `AppConfigReadRole` with an attached policy that allows `s3:GetObject` on the target bucket. However, the application fails to retrieve the templates and receives an 'Access Denied' error. The developer inspects the trust policy of `AppConfigReadRole` and finds the following document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following modifications to the trust policy will resolve the Access Denied error and allow the EC2 instance to assume the role?

A developer is configuring an AWS Step Functions state machine to orchestrate a serverless workflow. The state machine needs to invoke an AWS Lambda function and publish execution status updates to an Amazon SNS topic. During testing, the state machine execution fails with an IAM authorization error. Which of the following configurations are required to resolve this issue and grant the state machine the necessary permissions? (Select TWO.)

An application running on an Amazon ECS container using AWS Fargate in Account $A$ ($111122223333$) needs to write objects to an Amazon S3 bucket in Account $B$ ($444455556666$). The application code uses the AWS SDK to call the AWS Security Token Service (STS) `AssumeRole` API to assume an IAM role named `CrossAccountS3Writer` in Account $B$. However, the application receives an `AccessDenied` error on the `AssumeRole` call.

The ECS task definition is configured with the `taskRoleArn` parameter set to `arn:aws:iam::111122223333:role/ecsTaskRole` and the `executionRoleArn` parameter set to `arn:aws:iam::111122223333:role/ecsTaskExecutionRole`.

Which two actions are required to resolve this access issue and allow the application to write to the S3 bucket? (Select TWO.)

A developer is implementing Attribute-Based Access Control (ABAC) in an AWS account. The developer configures an IAM role named `ProjectRunnerRole` with the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:user/AppDeveloper"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"aws:RequestTag/Project": "Phoenix",
"aws:RequestTag/CostCenter": "1001"
}
}
}
]
}

An IAM user named `AppDeveloper` in the same account attempts to assume this role by calling the `sts:AssumeRole` API and passing the session tags `Project=Phoenix` and `CostCenter=1001`. The request fails with an `AccessDenied` error. Which TWO of the following configurations are required to resolve this error and successfully allow the user to assume the role?

A developer has configured an AWS Lambda function in Account A ($111111111111$) to retrieve configuration files from a secured Amazon S3 bucket in the same account. The developer created an IAM role named `LambdaS3ReaderRole` with the following trust policy and permissions policy, and assigned it as the function's execution role:

Trust Policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Permissions Policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::app-config-bucket-1111/*"
}
]
}

During local testing, the developer used their own IAM user access keys, which had administrative privileges. Before deploying to the Lambda environment, the developer committed the following code:

python
import boto3
import os

def lambda_handler(event, context):
# Initialize the S3 client
s3_client = boto3.client(
's3',
aws_access_key_id=os.environ.get('AWS_ACCESS_KEY_ID', 'AKIAIOSFODNN7EXAMPLE'),
aws_secret_access_key=os.environ.get('AWS_SECRET_ACCESS_KEY', 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY')
)

try:
response = s3_client.get_object(
Bucket='app-config-bucket-1111',
Key='settings.json'
)
return response['Body'].read().decode('utf-8')
except Exception as e:
print(f"Error: {str(e)}")
raise e

After deploying the Lambda function, the execution fails with an `AccessDenied` error when trying to retrieve the S3 object. The developer verifies that the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are not set in the Lambda function's configuration.

Which of the following options explains the cause of this authorization failure, and describes the correct way to resolve it?

A developer is implementing a serverless application where an AWS Lambda function in Account A ($111122223333$) needs to access a DynamoDB table in Account B ($444455556666$). The developer creates an IAM role named `CrossAccountDynamoDBRole` in Account B that has the required permissions to access the DynamoDB table. The Lambda function is configured with an execution role named `arn:aws:iam::111122223333:role/LambdaExecutionRole` and runs code that calls the `AssumeRole` API of AWS Security Token Service (STS) to assume `CrossAccountDynamoDBRole`.

However, when the Lambda function runs, the `AssumeRole` call fails with an `AccessDenied` error. The developer reviews the trust policy of `CrossAccountDynamoDBRole` in Account B:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy of `CrossAccountDynamoDBRole` in Account B will resolve this error?

A developer is setting up an application on an on-premises server that must archive daily transaction logs to a private Amazon S3 bucket. To implement this securely without storing long-term credentials on the server, the developer creates an IAM User named `archive-agent` in the AWS account `111122223333` and an IAM Role named `S3UploaderRole` that has permissions to write to the S3 bucket. The application will authenticate as `archive-agent` using short-term configurations and then assume `S3UploaderRole` to perform the S3 uploads.

Which two configuration policies are required to establish this role-assumption trust relationship and grant the necessary permissions? (Select two.)

A developer is implementing an AWS Lambda function in AWS Account $111111111111$ (Account A) that must write messages to an Amazon SQS queue in AWS Account $222222222222$ (Account B). The security team requires using temporary security credentials via IAM role assumption for cross-account access. The Lambda function is configured with an execution role named `LambdaExecutionRole` in Account A.

The developer attempts to set up an IAM role in Account B named `QueueWriterRole` with the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following actions are required to successfully and securely establish this cross-account access? (Select TWO.)

A developer is configuring an AWS Lambda function to retrieve messages from an Amazon SQS queue. To follow the security principle of least privilege, the developer decides to create a custom IAM role for the Lambda function. Which of the following configurations are required to establish this access? (Select TWO.)

A developer is configuring an AWS Lambda function in AWS Account A (111111111111) that needs to read objects from an Amazon S3 bucket in AWS Account B (222222222222) by assuming an IAM role named CrossAccountS3Reader in Account B. The Lambda function is assigned an execution role in Account A named LambdaExecutionRole. However, when the Lambda function attempts to assume the CrossAccountS3Reader role using AWS STS, the API call fails with an AccessDenied error. Which of the following configurations are required to resolve this issue? (Select TWO.)

A developer is deploying a Java application on Amazon EC2 instances in AWS account `123456789012`. The application requires access to retrieve database credentials from AWS Systems Manager Parameter Store. The developer creates an IAM role named `SSMParameterReaderRole` and attaches a permissions policy that allows the `ssm:GetParameter` action. The developer then configures an Amazon EC2 Instance Profile to associate the EC2 instances with this role. During startup, the application fails to retrieve the parameters, and CloudTrail logs show that the EC2 service was unable to assume the role.

The trust policy currently attached to `SSMParameterReaderRole` is as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification must the developer make to the trust policy of `SSMParameterReaderRole` to resolve this issue?

A developer is deploying a containerized application to Amazon ECS using AWS Fargate. The application needs to perform read and write operations on an Amazon DynamoDB table. Additionally, the ECS agent must pull the container image from a private Amazon ECR repository and send container startup logs to Amazon CloudWatch Logs.

To satisfy these security requirements using the principle of least privilege, how should the developer configure the IAM roles?

A developer is setting up an Amazon EventBridge rule to route custom application events to an Amazon Kinesis Data Firehose delivery stream. The developer creates an IAM role named `EventBridgeToFirehoseRole` to allow EventBridge to put records into the delivery stream. The IAM role has the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

The permissions policy attached to the role is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"firehose:PutRecord",
"firehose:PutRecordBatch"
],
"Resource": "arn:aws:firehose:us-east-1:123456789012:deliverystream/my-stream"
}
]
}

However, when events are triggered, EventBridge fails to send the events to the delivery stream. Which of the following changes will resolve this issue?

A developer is deploying an AWS Lambda function that reads incoming user data from an Amazon Kinesis data stream. The developer creates an IAM role with a permissions policy allowing the necessary Kinesis read actions. However, the Lambda function fails to retrieve data, and the logs indicate that the Lambda service is unauthorized to assume the configured execution role.

The trust policy attached to the IAM role is shown below:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "kinesis.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

How should the developer resolve this issue to allow the Lambda function to execute and read from the stream?

A developer is configuring an AWS Lambda function in Account A ($123456789012$) to write data to an Amazon DynamoDB table in Account B ($210987654321$). The developer wants to use a cross-account IAM role named `DynamoDBWriterRole` in Account B to perform the DynamoDB operations. The Lambda function runs under an execution role named `LambdaExecutionRole` in Account A. Which two configurations are required to establish this cross-account trust and allow the Lambda function to write to the table? (Select TWO.)

A developer is configuring an AWS CodeBuild project in Account $111111111111$ that must retrieve database configuration credentials from AWS Systems Manager Parameter Store in Account $222222222222$. The developer creates an IAM role named CrossAccountParamReaderRole in Account $222222222222$ with permission to read the parameters.

The CodeBuild project's service role in Account $111111111111$ has permissions to assume CrossAccountParamReaderRole. However, during the build phase, the CodeBuild build fails with an AccessDenied error when executing the assume-role CLI command.

The trust policy for CrossAccountParamReaderRole in Account $222222222222$ is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy in Account $222222222222$ will resolve this issue?

A developer is configuring a local application to access an Amazon DynamoDB table in an AWS account. To comply with security best practices, the application must run locally by assuming an IAM role named DbAccessRole using temporary credentials. The developer has a local AWS CLI profile named dev-user configured with IAM user credentials.

Which two actions must the developer take to configure the application to assume the role?