Lambda Execution Role with SNS Topic Access
I have created a SNS topic access policy for "Infra-Alert" to allow sns:publish action from the cloud watch log resource only.
I have lambda execution role which has permission for sns:publish for all sns resources.
First question is, I have never define the sns topic policy to allow the sns:publish action from lambda, how come lambda can publish the sns message to this topic? Second question is, if I remove the 'sns:publish' from the lambda execution role, but add the lambda access in SNS topic access policy, why the lambda will not have publish permission access to the sns?
Based on this AWS doc - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html Identity-based policies and resource-based policies are both permissions policies and are evaluated together. For a request to which only permissions policies apply, AWS first checks all policies for a Deny. If one exists, then the request is denied. Then AWS checks for each Allow. If at least one policy statement allows the action in the request, the request is allowed. It doesn't matter whether the Allow is in the identity-based policy or the resource-based policy.
Thank you so much in advance for help me check on it.
- Newest
- Most votes
- Most comments
To answer your questions about Lambda and SNS permissions:
For your first question: Your Lambda function can publish to the SNS topic because the Lambda execution role has the sns:publish permission for all SNS resources. When Lambda executes, it assumes this role and inherits all its permissions. The execution role's policy is an identity-based policy that grants the Lambda function permission to access AWS services and resources, including publishing to any SNS topic.
For your second question: If you remove the sns:publish permission from the Lambda execution role but add Lambda access in the SNS topic access policy, the Lambda function would not be able to publish to the SNS topic. This is because Lambda functions primarily use their execution role (identity-based policy) to determine what actions they can perform.
While your understanding of how identity-based and resource-based policies work together is generally correct, there's an important distinction with Lambda functions. When a Lambda function executes, it operates using the permissions granted by its execution role. The function itself doesn't have an identity separate from this role that could be recognized by a resource-based policy on the SNS topic.
For Lambda to publish to an SNS topic, the Lambda execution role must have the necessary permissions. The SNS topic's resource-based policy controls which principals can access the topic, but the Lambda function still needs the appropriate permissions in its execution role to make the API calls.
In summary, Lambda functions need permissions in their execution role to perform actions on AWS resources, regardless of the resource-based policies that might exist on those resources.
Sources
Defining Lambda function permissions with an execution role - AWS Lambda
Using identity-based policies with Amazon SNS - Amazon Simple Notification Service
How Lambda works - AWS Lambda
It's using a combination of resource policy and IAM policy. Since, there is no deny in the resource policy and the IAM policy allows it, so, Lambda can access SNS. [https://docs.aws.amazon.com/sns/latest/dg/sns-access-policy-language-evaluation-logic.html]
Relevant content
asked 2 years ago
asked 2 years ago
- AWS OFFICIALUpdated 7 months ago
Then how about ecs task role? If I never allow the sns:publish action in ecs task role, the ecs cannot use the sns:publish. Other than lambda, ecs use case, is there any other use case similar to lambda execution role?