You want to allow a Lambda function in account A to assume a role in account B. What must the trust policy in account B include?

hard📝 Application Q9 of 15

AWS - Identity and Access Management

APrincipal with AWS service "lambda.amazonaws.com" only

BPrincipal with IAM user ARN from account A

CPrincipal with Lambda execution role ARN from account A

DPrincipal with EC2 service ARN

Step-by-Step Solution

Solution:

Step 1: Understand cross-account trust
The trust policy must specify the Lambda execution role ARN from account A as Principal to allow the Lambda function to assume the role.
Step 2: Evaluate options
Principal with Lambda execution role ARN from account A correctly specifies the Lambda execution role ARN. Principal with AWS service "lambda.amazonaws.com" only trusts all Lambda service but not cross-account. Principal with IAM user ARN from account A trusts a user, not the Lambda function. Principal with EC2 service ARN trusts EC2, unrelated.
Final Answer:
Principal with Lambda execution role ARN from account A -> Option C
Quick Check:
Cross-account trust requires specific Principal ARN [OK]

Quick Trick: Cross-account roles need exact Principal ARN of caller [OK]

Common Mistakes:

Master "Identity and Access Management" in AWS

9 interactive learning modes - each teaches the same concept differently

Want More Practice?

15+ quiz questions · All difficulty levels · Free

More AWS Quizzes