ExamPark
Course menuDVA-C02

Exams / DVA-C02 / IAM roles, policies and STS / Question 1

DVA-C02 practice question: IAM roles, policies and STS (1 of 3)

Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

A Lambda function in account A (111111111111) must write items to a DynamoDB table in account B (222222222222). The security team in account B requires that access is granted only through an IAM role in account B that they manage. Which TWO steps are required? (Choose two.)

Choose two answers.

  1. A. Create an IAM user in account B and store its access keys in the function's environment variables.
  2. B. In account B, create a role with DynamoDB write permissions and a trust policy that allows the function's execution role to assume it.
  3. C. Add a statement to the function's resource-based policy that names the role in account B.
  4. D. Allow sts:AssumeRole on the account B role's ARN in the function's execution role, and call AssumeRole in code.
  5. E. Attach the AWS managed AdministratorAccess policy to the function's execution role in account A.
Show the answer and explanation

Answers: B, D

  • A. Wrong: Long-term keys in environment variables go against best practice and do not use a role, as the security team requires.
  • B. Right: Correct. The trust policy controls who may assume the role, and its permissions policy controls what they can do in account B.
  • C. Wrong: The function's resource-based policy controls who may invoke the function. It does not affect what the function can access.
  • D. Right: Correct. The caller also needs permission to assume the role. The code then uses the temporary credentials returned by STS.
  • E. Wrong: Permissions in account A do not grant access to resources in account B, and this breaks least privilege.

Explanation

Cross-account role access needs agreement from both sides. The role in the trusting account (B) has a trust policy naming the trusted principal, and the principal in account A needs an identity policy that allows sts:AssumeRole on that role. The function then calls AssumeRole and uses the temporary credentials.

Study

Keep practising

Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C02 practice examPractise IAM roles, policies and STSAll IAM roles, policies and STS questions