The IAM policy on your lambda function must not have the correct permissions. There are a few things to try:
- Can you temporary grant
sqs:*permissions instead of just CreateQueue and test that?
- Can you look at CloudTrail to see which API calls are getting denied?
If the lambda works fine when deployed using a zip file or from the console, then there is no issue with IAM permissions.
If it is not working as expected only when it is deployed as a container, then there must be some issue with the container configuration. Please make sure you have followed the steps as mentioned in this blog post - https://aws.amazon.com/blogs/aws/new-for-aws-lambda-container-image-support/
Have you tested the container locally?
I agree with Indranil, It's probably a configuration issue in the container. My first guess would be that you have set one or more environment variables in the image:
If you run the shell command
env, it will print all your environment variables, you can do this at the end of your docker file or when the lambda starts. You can also unset this with this command in your Dockerfile:
RUN unset AWS_ACCESS_KEY_ID; unset AWS_SECRET_ACCESS_KEY; unsetAWS_ACCESS_KEY_ID; unset AWS_PROFILE
Or that the image has a ~/.aws/... directory so that the program picks up the wrong credentials (not from your role). If this is the case, run this in your docker file:
RUN rm -rf ~/.aws
Find more info about how the boto3 client reads its credentials here: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html
Can't get EventBridge rule to create a message in SQSasked 8 months ago
is it possible that SQS Triggers to a Lambda Function Alias?Accepted Answerasked 10 months ago
Invoke a lambda function (cross account) from event bridgeAccepted Answerasked a year ago
Multiple SQS queue to same Lambdaasked 8 months ago
Return Value from Lambda function triggered by SQS to individual clientAccepted Answerasked 10 months ago
SQS batching S3 events issueasked 10 months ago
How can I prevent an Amazon SQS message from invoking my Lambda function more than once?EXPERTasked a year ago
Can't Create SQS Queue From Docker-based LambdaAccepted Answerasked 3 months ago
At what point is an AWS SQS queue overkill as a Lambda function's source?asked 8 months ago
What if a Lambda function fails to process an SQS message within the visibility timeout of the queue?asked 2 months ago