Exam AWS Certified Data Engineer - Associate DEA-C01 topic 1 question 105 discussion

The lambda resource based policy must allow the events principle to invoke the lambda function. https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-run-lambda-schedule.html#eb-schedule-create-rule and https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-run-lambda-schedule.html#eb-schedule-create-rule Amazon SQS, Amazon SNS, Lambda, CloudWatch Logs, and EventBridge bus targets do not use roles, and permissions to EventBridge must be granted via a resource policy.

Option B

Only B - makes sense

"B" is corect because the only way to resolve the AccessDeniedException message is to make sure both the IAM role for EventBridge and the Lambda function's resource-based policy have the necessary permissions.

The trust policy is what grants an AWS service permission to use the role on behalf of the user. Without this trust relationship, EventBridge won’t have the necessary permissions to invoke the Lambda function.

IAM Role for EventBridge: EventBridge needs permission to invoke the Lambda function. Lambda Resource-Based Policy: The Lambda function must have a resource-based policy that allows EventBridge to invoke it.