A municipal API architecture uses a resource-based policy on an Amazon SQS queue so only a named Lambda execution role can consume messages. What principle does this apply?
Select an answer to reveal the explanation.
Short Explanation
The queue can hang a sign that says “only PermitLambdaRole may pull messages.” That resource policy works with the role’s identity policy—both doors need to line up. It is not limited to S3, and same-account callers still get evaluated.
Full Explanation
Many AWS services support resource-based policies that name allowed principals, including SQS queue policies that permit only a specific Lambda execution role to call ReceiveMessage and related APIs. Access still depends on the identity policy and resource policy evaluation model; same-account access is not automatically unrestricted, and organization membership alone does not grant consume rights.