Cannot create function after giving create function permission to a policy used by a role referenced in the "Create function" workflow
Hi re:Post!
Thank you for your time and help!
Policy:
I created a Policy (RDS_Policy_Lamda_Manage_Snapshots) with these permissions:
rds:DescribeDBSnapshots
rds:CopyDBSnapshot
rds:DeleteDBSnapshot
rds:CrossRegionCommunication
lambda:ListFunctions
lambda:CreateFunction
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBSnapshots",
"rds:CopyDBSnapshot",
"rds:DeleteDBSnapshot",
"rds:CrossRegionCommunication",
"lambda:ListFunctions",
"lambda:CreateFunction"
],
"Resource": [
"*"
]
}
]
}
Role:
I then attached this policy to a Role (RL-Lambda-RDS-Snapshot-Management ) for a Lambda function to use.
Lambda Function:
Now I am trying to create that Lambda function (Lambda-Function-RDS-Snapshot-Management) and assign it my role. But when I select "Create Function" I get:
*Access denied to lambda:CreateFunction You don't have permission to lambda:CreateFunction. To request access, copy the following text and send it to your AWS administrator. *
I'm confused, I added the "CreateFunction" to the policy that is attached to the role which is trying to create the lambda function. But obviously I'm doing something wrong here ! :)
Please advise! Thanks! Best Regards, Donald
Some screenshots below:
- Topics
- ServerlessCompute
- Language
- English
asked a year ago141 views
- Newest
- Most votes
- Most comments
The issue you're experiencing is related to IAM permissions, but not in the way you might think. There's a misunderstanding about how the permissions work in this scenario.
The policy you created (RDS_Policy_Lamda_Manage_Snapshots) with the lambda:CreateFunction permission is intended to be used by the Lambda function itself after it's created, not by your user account that's trying to create the Lambda function.
When you're in the AWS console trying to create a Lambda function, you're using your own IAM user/role permissions, not the permissions of the role you're trying to assign to the Lambda function. The role you're creating (RL-Lambda-RDS-Snapshot-Management) will only be assumed by the Lambda function after it's created, to perform actions like managing RDS snapshots.
To fix this issue, you need to ensure that your IAM user or role (the one you're using to access the AWS console) has the lambda:CreateFunction permission. This is separate from the permissions you're granting to the Lambda execution role.
You should:
- Check what IAM user/role you're currently using to access the AWS console
- Make sure that user/role has the necessary Lambda permissions (lambda:CreateFunction at minimum)
- You can add these permissions by attaching an appropriate policy to your user/role
If you're using an AWS account managed by Organizations, there might also be Service Control Policies (SCPs) that restrict Lambda operations regardless of your IAM permissions. In that case, you would need to contact your AWS account administrator.
If you continue to experience issues even with the correct permissions, there could be a temporary service disruption with AWS IAM or Lambda services. In such cases, waiting for a short period and trying again might resolve the issue.
Sources
Failed to create Lambda function simply withe the error message "The role defined for the function cannot be assumed by Lambda" | AWS re:Post
Access Denied Error when I visit Lambda dashboard ans not able to create Function | AWS re:Post
Access denied in creating lambda function | AWS re:Post
Relevant content
asked a year ago
Thank you for that explanation. This has helped me move on in my process.
What I did was : Workflow: adding a policy to a group adding a user to group create lambda function
Group: Group_Lambda_Create_Functions Policy: RDS_Policy_Lambda_CreateFunction
"Attach policies directly: Attach a managed policy directly to a user. As a best practice, we recommend attaching policies to a group instead. Then, add the user to the appropriate group."
So then this policy: RDS_Policy_Lambda_CreateFunction
Is attached to a group: Group_Lambda_Create_Functions
And I can add a user to the group: "1 user added to this group."
Then I attached the group policy to my "Lambda-Function-RDS-Snapshot-Management"