Crucial Exams

AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

An operations team runs a Lambda function named ValidateTag in AWS account 111111111111. A custom AWS Config rule that resides in account 222222222222 must invoke this function. Security policy states that all permissions must be managed from account 111111111111 and that no IAM roles may be created or modified in account 222222222222. Which approach meets these requirements while following the principle of least privilege?

  • Add a permission to the Config rule that allows it to assume a role in account 111111111111 which has lambda:* permissions on the function.

  • From account 111111111111 run aws lambda add-permission --function-name ValidateTag --statement-id AllowConfigCrossAccount --action lambda:InvokeFunction --principal config.amazonaws.com --source-account 222222222222, which adds a resource-based policy to the function.

  • Share the ValidateTag function with account 222222222222 by using AWS Resource Access Manager; the share automatically grants invoke permissions to AWS Config.

  • Create an IAM role in account 222222222222 that trusts account 111111111111, attach the lambda:InvokeFunction permission to it, and reference the role ARN in the Config rule.

AWS Certified CloudOps Engineer Associate SOA-C03
Security and Compliance
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot