How do I troubleshoot Lambda function permission issues?

Short description

Lambda function permission issues occur because of the following reasons:

• The Lambda function doesn't have permission to run the actions in the code.
• The AWS service associated with the Lambda function doesn't have sufficient permission to invoke the function.
• An AWS user account doesn't have valid permissions to create, update, or delete Lambda resources.

Resolution

To troubleshoot Lambda function permission issues, review the section for your scenario.

Lambda function can't invoke another function or an AWS service

If the Lambda function tried to invoke another function or another AWS service and it failed, then check the Lambda functions execution role. The execution role must grant the specific actions your function code calls. Make sure that the execution role AWS Identity and Access Management (IAM) policy includes the required actions. Also, make sure the IAM policy includes the correct resource Amazon Resource Name (ARN) for the target service.

If the role has the correct permissions, then check for the following:

• An explicit Deny in the target resource's policy that overrides the Allow in the execution role.
• An AWS Key Management Service (AWS KMS) key policy that doesn't grant the execution role access. Both the IAM policy and the AWS KMS key policy must allow execution role access. For more information, see How do I resolve Lambda function "KMS Exception" permission errors?
• Service Control Policies (SCPs) that block actions even when the execution role allows them. For more information, see How do I troubleshoot explicit deny in a service control policy errors?
• A permissions boundary on the execution role that restricts access.

AWS service can't invoke the function

If an AWS service can't invoke the Lambda function, then check the function's resource-based policy. A resource-based policy grants other AWS services or AWS accounts permission to invoke your function. If the resource-based policy doesn't exist or doesn't include the invoking service as a principal, then the invocation fails.

For more information, see How do I use resource-based policies with Lambda to grant permission to AWS services?

IAM user or role can't access Lambda resources

If an IAM user or role can't create, update, or delete Lambda resources, then check the identity-based policy. The identity-based policy attached to the IAM user or role must include the required Lambda API actions. Additionally, the user or role requires iam:PassRole permissions on the execution role ARN to assign it to a Lambda function.

For more information, see How do I provide granular access to Lambda functions?

Lambda function can't assume a role in another AWS account

For cross-account scenarios, you must configure your Lambda function execution role to allow the function to assume an IAM role in another AWS account. Make sure that you update your cross-account IAM role trust policy to allow your Lambda function to assume the role. Also, make sure that you add the AWS Security Token Service (AWS STS) AssumeRole API call to your Lambda function code.

For more information, see How do I configure a Lambda function to assume an IAM role in another AWS account?

Lambda function can't access resources in an Amazon VPC

If your function can't access resources in an Amazon Virtual Private Cloud (Amazon VPC), then check your configuration requirements. Your function must have the required IAM permissions to access resources in an Amazon VPC.

For more information, see Giving Lambda functions access to resources in an Amazon VPC. Also, see How do I give internet access to a Lambda function that's connected to Amazon VPC?

Use CloudTrail to review Lambda API calls

Review AWS CloudTrail logs, event history, and management events to get more information about the permission failures. Review the information to find the API requests, the principal, error code, and condition keys that failed evaluation.

Also, use AWS Identity and Access Management Access Analyzer to check policies and find gaps.

For more information, see Logging Lambda API calls using CloudTrail.

Related information

How do I configure a Lambda function to assume an IAM role in another AWS account?

How do I provide granular access to Lambda functions?

Troubleshoot access denied (403 Forbidden) errors in Amazon S3