Question

A security engineer creates an IAM role that an AWS Lambda function will assume to read objects from an S3 bucket. The role's permissions policy grants the required s3:GetObject action. However, when the Lambda function runs, it fails to assume the role and cannot access the bucket. The engineer confirms the Lambda execution configuration references this exact role ARN. Which change to the role is MOST likely required to resolve the failure?

Accepted Answer

Add lambda.amazonaws.com as a trusted service principal in the role's trust policy (assume-role policy document).

Answer

Attach a resource-based policy to the S3 bucket that allows the Lambda function's role ARN to call s3:GetObject.

Answer

Add a permissions boundary to the role that grants s3:GetObject to widen the effective permissions.

Answer

Increase the role's maximum session duration so that Lambda has enough time to complete the assume-role call.