Following error when trying to create a Lambda Function: An error occurred (AccessDeniedException) when calling the CreateFunction operation: None

0

I'm trying to use the AWS CLI to create a Lambda function from an ECR image but no matter what permissions I give my IAM user, I keep getting this error. I pasted the permissions my IAM user has below, as well as the AWS CLI command I'm using. I even checked with the policy simulator which says I should be able to call the CreateFunction function. I'm not sure what policies I'm missing or what is causing this error. Any help would be great!

IAM Policies:

  • IAMReadOnlyAccess
  • AmazonS3FullAccess
  • AmazonEC2ContainerRegistryPowerUser
  • AmazonDynamoDBFullAccess

Actions on Custom Policies with resource defined as "*":

  • lambda:CreateFunction
  • lambda:UpdateFunctionCode
  • iam:PassRole
  • lambda:GetFunction
  • lambda:UpdateFunctionConfiguration
  • logs:CreateLogGroup
  • logs:CreateLogStream
  • logs:PutLogEvents
  • ecr:GetAuthorizationToken

Actions on Custom Policies with resource defined as the ARN of the ECR image:

  • ecr:GetDownloadUrlForLayer
  • ecr:BatchGetImage
  • ecr:CompleteLayerUploadecr:UploadLayerPart
  • ecr:InitiateLayerUpload
  • ecr:BatchCheckLayerAvailability
  • ecr:PutImage

Running the following ECR Command: aws lambda create-function --function-name guest-registration --handler app.handler --package-type Image --role **** --runtime python3.7 --code 'ImageUri=<link-to-ecr-image>' --region us-east-1

1 Answer
1

According to the Developer Guide, you should ensure that the permissions for the IAM user or role that creates the function contain the AWS managed policies GetRepositoryPolicy and SetRepositoryPolicy.

{
  "Effect": "Allow",
  "Action": [ "ecr:SetRepositoryPolicy", "ecr:GetRepositoryPolicy" ],
  "Resource": "arn:aws:ecr:<region>:<account>:repository/<repo name>/"
}

These permissions are not set for your IAM user, according to the list you provided.

Alternatively, for a function in the same account as the container image in Amazon ECR, you can add ecr:BatchGetImage and ecr:GetDownloadUrlForLayer permissions to your Amazon ECR repository. It is unclear from your question, but it seems you granted these permissions to the IAM user that creates the function instead. However, the permissions should be granted to the AWS Lambda service as shown below:

{
        "Sid": "LambdaECRImageRetrievalPolicy",
        "Effect": "Allow",
        "Principal": {
          "Service": "lambda.amazonaws.com"
        },
        "Action": [
          "ecr:BatchGetImage",
          "ecr:GetDownloadUrlForLayer"
        ]
    }   

To view or edit your Amazon ECR repository permissions, follow the directions in Setting a repository policy statement.

profile pictureAWS
answered a year ago
  • Hey Dmitry, you were correct and I did add those to the IAM user and not the ECR Repository. I went back and added those to the repository permissions and added the GetRepositoryPolicy and SetRepositoryPolicy policies to the IAM role creating the Lambda. However, I am still getting the same error. Do you have any other ideas as to what could be causing this? Thanks again!

  • There might be several reasons for that. Do you use MFA? You might need to authenticate with AWS CLI using MFA. If your Account is part of an AWS Organization, check if there are any restricting SCPs. Also, check if there are any permission boundaries attached to your IAM user or role. You might also try the troubleshooting options described in the documentation and in this knowledge base post.

  • No I don't use MFA and I'm also not a part of any AWS Organization. Also double checked and my IAM user doesn't have any permission boundaries set. I looked through that documentation already but the error I get doesn't match any of those so I wasn't able to get much from it. That post was super helpful in seeing all the access denied errors; however, for some reason, it isn't showing the access denied related to my create function call. I made sure to set the date/time appropriately and made a call to the createFunction function but nothing was reported in Cloudtrails, which I think is odd.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content