DVA-C02 · Question #259
An AWS Lambda function is running in a company's shared AWS account. The function needs to perform an additional ec2:DescribeInstances action that is directed at the company's development accounts…
The correct answer is B. Create an IAM role in the development accounts. Add the ec2:DescribeInstances permission to. The correct approach is to create a cross-account IAM role in the development accounts that trusts the shared account's Lambda execution role, following least privilege.
Question
An AWS Lambda function is running in a company's shared AWS account. The function needs to perform an additional ec2:DescribeInstances action that is directed at the company's development accounts. A developer must configure the required permissions across the accounts. How should the developer configure the permissions to adhere to the principle of least privilege?
Options
- ACreate an IAM role in the shared account. Add the ec2:DescribeInstances permission to the role.
- BCreate an IAM role in the development accounts. Add the ec2:DescribeInstances permission to
- CCreate an IAM role in the shared account. Add the ec2:DescribeInstances permission to the role.
- DCreate an IAM role in the development accounts. Add the ec2:DescribeInstances permission to
How the community answered
(31 responses)- A16% (5)
- B74% (23)
- C3% (1)
- D6% (2)
Why each option
The correct approach is to create a cross-account IAM role in the development accounts that trusts the shared account's Lambda execution role, following least privilege.
Attaching ec2:DescribeInstances to a role in the shared account would only allow describing instances within the shared account, not in the development accounts. Cross-account EC2 API calls require a role in the target account.
Creating the IAM role in each development account with ec2:DescribeInstances permission and a trust policy that allows the shared account's Lambda execution role to assume it is the standard cross-account delegation pattern. The Lambda assumes the role in each development account using STS AssumeRole, scoping permissions only to the resources in those accounts without granting broad shared-account permissions.
A role in the shared account cannot directly describe resources in development accounts; the permission must exist in the target accounts where the EC2 instances reside.
Adding the shared account's Lambda role as a principal in a trust policy attached to a role in the development accounts is correct, but giving the Lambda additional permissions beyond assuming the role would violate least privilege.
Concept tested: Cross-account IAM role assumption with least privilege
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html
Community Discussion
No community discussion yet for this question.