Q32 — AWS SAA-C03 Ch.17

Question 32 of 89 | ← Chapter 17

Q1332. A company uses AWS Lambda functions in AWS account A. The company manages an Amazon S3 bucket in AWS account B. The Lambda function in account A needs to read objects from the S3 bucket in account

• A. A solutions architect needs to design a secure solution for cross-account access and maintain the principle of least privilege.Which solution will meet these requirements? ✓
• B. Create an IAM role in account B that has the necessary S3 permissions and a trust relationship with account A. Configure the Lambda function to assume this IAM role.
• C. Create an IAM role in account A that has the necessary S3 permissions and a trust relationship with account B. Create an IAM user in account B that has permission to assume this IAM role.Configure the Lambda function to use this IAM user.
• D. Create an IAM user in account B that has the necessary S3 permissions and a trust relationship with account A. Create an IAM user in account A that has permission to assume the account B user.Configure the Lambda function to use the account A user.
• E. Create an IAM role in account B that has the necessary S3 permissions and a trust relationship with account A. Create an IAM user in account A that has permission to assume this IAM role.Configure the Lambda function to use this IAM user.

Correct Answer: A. A solutions architect needs to design a secure solution for cross-account access and maintain the principle of least privilege.Which solution will meet these requirements?

Explanation

Correct Answer: ACreate an IAM role in account B that has the necessary S3 permissions and a trust relationship with account A. Configure the Lambda function to assume this IAM role.Why This Solution is Best?This approach follows the principle of least privilege while enabling secure cross-account S3 access for the Lambda function in account A. Here's why:IAM Role in Account B (Resource Account)The role is created in the account that owns the S3 bucket (account B), ensuring fine-grained control over permissions.The role is granted only the necessary S3 permissions (e.g., s3:GetObject, s3:ListBucket).Trust Relationship with Account AThe role's trust policy explicitly allows account A (or the Lambda function's execution role in account A) to assume the role.Example trust policy:json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": "arn:aws:iam::ACCOUNT_A_ID:role/LambdaExecutionRole"}, "Action": "sts:AssumeRole"}]}Lambda Function Assumes the RoleThe Lambda function in account A is configured to assume the cross-account role in account B using AWS Security Token Service (STS).The Lambda's execution role must have permission to call sts:AssumeRole for the cross-account role.Example Lambda execution role permission:json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "sts:AssumeRole","Resource": "arn:aws:iam::ACCOUNT_B_ID:role/CrossAccountS3AccessRole" }]}Security & Least PrivilegeNo hardcoded credentials--IAM roles use temporary security tokens. Minimal permissions--Only the Lambda function in account A can assume the role, and only for S3 access. Auditability--All cross-account access is logged in AWS CloudTrail.Why Other Options Are Incorrect?B. IAM Role in Account A with Trust to Account B + IAM User in Account B Incorrect Trust Direction: The role should be in account B (where the S3 bucket resides), not account A. Unnecessary IAM User: Using an IAM user introduces long-term credentials, violating least privilege.C. IAM Users in Both Accounts with Cross-AssumptionIAM Users Are Insecure: IAM users have long-term credentials, increasing risk. Overly Complex: Requires manual credential management and violates least privilege. D. IAM Role in Account B + IAM User in Account A to Assume Role Unnecessary IAM User: The Lambda function should use its execution role to assume the cross-account role, not an IAM user.Extra Complexity: IAM users are not needed for serverless workflows.Final RecommendationOption A is the most secure, scalable, and AWS-native solution for cross-account S3 access.Implementation StepsIn Account B (S3 Bucket Owner):Create an IAM role (CrossAccountS3AccessRole) with S3 permissions (s3:GetObject, s3:ListBucket). Add a trust policy allowing account A's Lambda execution role to assume it.In Account A (Lambda Owner):Ensure the Lambda execution role has sts:AssumeRole permission for the cross-account role. Configure the Lambda function to use the cross-account role when accessing S3.Test Access:From the Lambda function, call sts:AssumeRole to get temporary credentials. Use those credentials to read from the S3 bucket in account B. This ensures secure, least-privilege cross-account access without hardcoded credentials.