SOA-C02 · Question #46
A SysOps administrator created an AWS CloudFormation template that provisions an Amazon EventBridge rule that invokes an AWS Lambda function. The Lambda function is designed to write event details…
The correct answer is C. Update the CloudFormation stack with an AWS::Lambda::Permission resource to ensure. Why C is correct: When an AWS service like EventBridge invokes a Lambda function, Lambda requires a resource-based policy - separate from the function's execution role - that explicitly grants the calling service permission to invoke it. The AWS::Lambda::Permission resource…
Question
A SysOps administrator created an AWS CloudFormation template that provisions an Amazon EventBridge rule that invokes an AWS Lambda function. The Lambda function is designed to write event details to an Amazon CloudWatch log group. The function has permissions to write events to Amazon CloudWatch Logs. However, the SysOps administrator discovered that the Lambda function is not running. How should the SysOps administrator resolve the problem?
Options
- AUpdate the CloudFormation stack to include an AWS::IAM::Role resource with the required IAM
- BUpdate the CloudFormation stack to include an AWS::IAM::Role resource with the required IAM
- CUpdate the CloudFormation stack with an AWS::Lambda::Permission resource to ensure
- DUpdate the CloudFormation stack with an AWS::Lambda::Permission resource to ensure
How the community answered
(31 responses)- A3% (1)
- B13% (4)
- C77% (24)
- D6% (2)
Explanation
Why C is correct: When an AWS service like EventBridge invokes a Lambda function, Lambda requires a resource-based policy - separate from the function's execution role - that explicitly grants the calling service permission to invoke it. The AWS::Lambda::Permission resource creates this policy, allowing EventBridge (principal: events.amazonaws.com) to trigger the function. Without it, EventBridge's invocation attempt is denied at the Lambda API level, so the function never runs regardless of what the function itself is allowed to do.
Why A and B are wrong: The Lambda execution role (an AWS::IAM::Role) controls what the Lambda function can do after it starts - writing to CloudWatch Logs in this case. The question states the function already has those permissions, so adding another IAM role does not fix the underlying problem: EventBridge cannot invoke the function in the first place.
Why D is wrong: D also references AWS::Lambda::Permission but would specify an incorrect configuration - likely the wrong principal or source ARN - meaning EventBridge still would not be authorized to trigger the function.
Memory tip: Think of two separate doors. The IAM execution role is the function's outbound key (what Lambda can access). The AWS::Lambda::Permission is the inbound lock (who can knock on Lambda's door). EventBridge needs you to unlock the inbound door - that's always AWS::Lambda::Permission.
Topics
Community Discussion
No community discussion yet for this question.