DVA-C02 · Question #347
A developer is building an event-driven application by using AWS Lambda and Amazon EventBridge. The Lambda function needs to push events to an EventBridge event bus. The developer uses an SDK to run…
The correct answer is C. Modify the Lambda function execution role to include permissions for the PutEvents EventBridge. Lambda functions authenticate to AWS services using their IAM execution role; the role must explicitly grant permission to call PutEvents on EventBridge.
Question
A developer is building an event-driven application by using AWS Lambda and Amazon EventBridge. The Lambda function needs to push events to an EventBridge event bus. The developer uses an SDK to run the PutEvents EventBridge action and specifies no credentials in the code. After deploying the Lambda function, the developer notices that the function is failing and there are AccessDeniedException errors in the logs. How should the developer resolve this issue?
Options
- AConfigure a VPC peering connection between the Lambda function and EventBridge.
- BModify their AWS credentials to include permissions for the PutEvents EventBridge action.
- CModify the Lambda function execution role to include permissions for the PutEvents EventBridge
- DAdd a resource-based policy to the Lambda function to include permissions for the PutEvents
How the community answered
(19 responses)- A5% (1)
- B11% (2)
- C84% (16)
Why each option
Lambda functions authenticate to AWS services using their IAM execution role; the role must explicitly grant permission to call PutEvents on EventBridge.
VPC peering is a network-level concern and has no effect on IAM authorization; AccessDeniedException is a permissions error, not a network connectivity error.
The developer's personal IAM credentials are irrelevant because Lambda does not use the deploying user's credentials at runtime; it uses the execution role's credentials.
When the X-Ray SDK specifies no credentials, the Lambda runtime automatically uses the function's IAM execution role to sign API requests. If the execution role's policy does not include events:PutEvents, EventBridge rejects the call with AccessDeniedException. Adding the required permission to the execution role resolves the error without changing any code.
A resource-based policy on the Lambda function grants external principals permission to invoke Lambda; it does not grant the Lambda function itself permission to call EventBridge.
Concept tested: Lambda execution role permissions for calling AWS services
Source: https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html
Community Discussion
No community discussion yet for this question.