DEA-C01 · Question #259
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company uses an enhanced fanout data stream in Amazon Kinesis Data Streams to receive streaming data from…
The correct answer is B. Add a resource-based policy to the data stream to allow read access for the cross-account. To enable cross-account Lambda processing of Kinesis Data Streams, the stream in Account A must explicitly allow the Lambda execution role from Account B. This is done by adding a resource-based policy on the Kinesis data stream to grant kinesis:SubscribeToShard and related…
Question
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company uses an enhanced fanout data stream in Amazon Kinesis Data Streams to receive streaming data from multiple producers. The company runs the data stream in an account named Account A. The company wants to use an AWS Lambda function in an account named Account В to process the data from the data stream. The company creates a Lambda execution role in Account В that has permissions to access data from the data stream in Account A. What additional step must the company take to meet this requirement?
Options
- ACreate a service control policy (SCP) to grant the data stream read access to the cross-account
- BAdd a resource-based policy to the data stream to allow read access for the cross-account
- CCreate a service control policy (SCP) to grant the data stream read access to the cross-account
- DAdd a resource-based policy to the cross-account Lambda function to grant the data stream read
How the community answered
(56 responses)- A11% (6)
- B80% (45)
- C2% (1)
- D7% (4)
Explanation
To enable cross-account Lambda processing of Kinesis Data Streams, the stream in Account A must explicitly allow the Lambda execution role from Account B. This is done by adding a resource-based policy on the Kinesis data stream to grant kinesis:SubscribeToShard and related read permissions to the cross-account role. Without this resource-based policy, the Lambda in Account B cannot consume the data.
Topics
Community Discussion
No community discussion yet for this question.