A DevOps team has created a Custom Lambda rule in AWS Config. The rule monitors Amazon Elastic Container Repository (Amazon ECR) policy statements for ecr:* actions. When a noncompliant repository is

Question

Options

• AModify the Lambda function's resource policy to grant AWS Config permission to invoke the
• BModify the SNS topic policy to include configuration changes for EventBridge to publish to the
• CModify the Lambda function's execution role to include configuration changes for custom AWS
• DModify all the ECR repository policies to grant AWS Config access to the necessary ECR API

• A
  7% (2)
• B
  19% (5)
• C
  70% (19)
• D
  4% (1)

Explanation

Explanation

When a Custom AWS Config Lambda rule fails to execute, the most likely culprit is insufficient IAM permissions on the Lambda function's execution role - the role that Lambda assumes when it runs. The execution role must have permissions to call AWS Config APIs (such as config:PutEvaluations) to report compliance results back to AWS Config, which is why modifying it resolves the issue.

Why the distractors are wrong:

• Option A is incorrect because the resource policy controls who can invoke the Lambda function (i.e., allowing AWS Config to trigger it), but if the function is already being invoked and failing during execution, the execution role is the problem - not the trigger permission.
• Option B is incorrect because the SNS topic policy governs EventBridge publishing notifications, which is a downstream step that only matters after the Lambda function successfully evaluates compliance - it doesn't affect Lambda execution.
• Option D is incorrect because AWS Config uses the Lambda execution role to perform evaluations; modifying ECR repository policies addresses a different access layer and is unrelated to why Lambda itself is failing.

Memory Tip: Think of it this way - Resource Policy = who can knock on Lambda's door; Execution Role = what Lambda can do once it's inside. If Lambda is running but failing, always check the execution role first.

No community discussion yet for this question.