CloudWatch Alarms is not authorized to perform: lambda:InvokeFunction on the resource because because no resource-based policy allows the lambda:InvokeFunction action

Just adding to what has been mentioned here earlier. First you need to add resource policy to your target lambda function through AWS CLI, catch here is, you can't add resource policy for Cloudwatch Alam through UI unlike other sources such as SNS, SQS etc, so you'll have to add resource policy through AWS CLI as mentioned in AWS Documentation:

aws lambda add-permission \
--function-name my-function-name \
--statement-id AlarmAction \
--action 'lambda:InvokeFunction' \
--principal lambda.alarms.cloudwatch.amazonaws.com \
--source-account 111122223333 \
--source-arn arn:aws:cloudwatch:us-east-1:111122223333:alarm:alarm-name

Once you add this to your target lambda function, CloudWatch Alarm should be able to invoke your lambda function.

Reference Doc: Using Amazon CloudWatch alarms

That error is telling you that the cloudwatch service does not have permission to invoke the lambda. The easiest way is update the resource policy to allow cloudwatch to invoke the service. [1]

If you provide a bit more details on what you are looking to build, we may be able to offer a more detailed answer or recommend patterns that are resilient.

[1] https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-actions-Lambda : Using Amazon CloudWatch alarms - Lambda alarm actions

Hi, I'm encountering a similar issue despite configuring all permissions correctly. When attempting to trigger an action via a CloudWatch alarm in AWS Lambda, I receive the following error message:

Error: Failed to execute action arn:aws:lambda:[region]:[account_id]:function:[function_name]. Received error: "CloudWatch Alarms is not authorized to perform: lambda:InvokeFunction on the resource because no resource-based policy allows the lambda:InvokeFunction action."

The CloudWatch alarms are being programmatically created and dynamically configured within a Lambda function, specifically to monitor CPU utilization and trigger at <10%. Everything seems to work fine: the alarms are created successfully, and the logic is functioning as expected, with the Lambda function set as the action trigger. However, when the alarm reaches the action state, the error appears in CloudWatch logs, and the Lambda function is not triggered.

I have already ensured that all permissions are set correctly. My Lambda function has a resource-based policy issued through the CLI with the appropriate lambda:InvokeFunction permissions.