Lab 06 - Access Denied VI
Difficulty: Intermediate Service: AWS IAM, AWS Lambda
Cost: This lab deploys only IAM resources — no charges apply.
Scenario
An automation role is used to create Lambda functions on behalf of the team. Each function needs an execution role attached at creation time. The stack deployed without errors and the automation role has a policy allowing it to create functions — but function creation fails with a permissions error whenever an execution role is specified.
What Was Deployed
| Resource | Purpose |
|---|---|
AWS::IAM::Role (target) |
Execution role intended to be attached to new Lambda functions |
AWS::IAM::Role (actor) |
Automation role that creates Lambda functions and must pass the execution role to them |
The stack deployed without errors. Both roles exist, and the automation role’s policy
allows lambda:CreateFunction.
Deploy the Lab
- Open the AWS CloudFormation console
- Click Create stack > With new resources (standard)
- Select Upload a template file and upload lab-06-access-denied-vi.yaml
- Enter a stack name (e.g.,
brokenlabs-iam-lab-06), click Next > Next - Check I acknowledge that AWS CloudFormation might create IAM resources and click Submit
- Wait for the stack status to reach CREATE_COMPLETE
- Open the stack Outputs tab — note
RoleNameandTestResourceArn
The Problem
Open the IAM Policy Simulator, select the role
named in the stack Outputs (RoleName), choose the iam:PassRole action, and set
the resource ARN to the TestResourceArn value from Outputs — this is the execution
role that needs to be passed to Lambda. Run the simulation.
Expected: the simulation result for iam:PassRole against this ARN shows
allowed.
Actual: the simulation result shows denied.
Fix the Lab
Diagnose why the simulation is denied and fix the role’s permissions so the result matches Expected above. Re-run the simulation to confirm your fix.
Need help? Open hints.md for progressive hints.
Cleanup
- Open CloudFormation, select your stack, and click Delete