Config rule with custom lambda permission issue

Question

I'm creating a config rule with custom lambda configuration but getting below error message.
Error :**
Before you add this rule, update your IAM permissions to allow the lambda:AddPermission action.**

could you please guide where we need to add these permission.

Riku_Kobayashi · Answer

Hello.

I think you need to add "config.amazonaws.com" to Lambda's resource-based policy.  
https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.html#restricted-lambda-policy  
```
aws lambda add-permission \
  --function-name InstanceTypeCheck \
  --statement-id "AddConfigPermission" \
  --action lambda:InvokeFunction \
  --principal config.amazonaws.com
```

I believe there needs to be a policy set on the IAM user you are using to allow "lambda:AddPermission".

Anup Badharudheen · Answer

Make sure you have proper IAM role for AWS Config with needed access to lambda and most importantly you have a resource based policy attached to your lambda function with permission as below :

```bash 
aws lambda add-permission \ 
  --function-name  \
  --statement-id ConfigInvokePermission \
  --action lambda:InvokeFunction \
  --principal config.amazonaws.com \
  --source-arn arn:aws:config:::config-rule/* \
  --region 
```

Config rule with custom lambda permission issue

Relevant content