AccessDeniedException: User is not authorized to perform: lambda:InvokeFunction

Question

I'm trying to invoke a lambda function from node.

var aws = require('aws-sdk');
var lambda = new aws.Lambda({
    accessKeyId: 'id',
    secretAccessKey: 'key',
    region: 'us-west-2'
});

lambda.invoke({
    FunctionName: 'test1',
    Payload: JSON.stringify({
        key1: 'Arjun',
        key2: 'kom',
        key3: 'ath'
    })
}, function(err, data) {
    if (err) console.log(err, err.stack);
    else     console.log(data);
});

The keys are for an IAM user. The user has AWSLambdaExecute and AWSLambdaBasicExecutionRole policies attached.

I get a permission error: AccessDeniedException: User: arn:aws:iam::1221321312:user/cli is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-west-2:1221321312:function:test1

I read the docs and several blogs, but I'm unable to authorise this user to invoke the lambda function. How do get this user to invoke lambda?

I heartily wish there were an aws cli or web interface to fix this. aws add-access "AccessDeniedException: User: ARN... is not authorized to perform: ACTION on resource: ARN..." maybe prompt you with a couple of description questions and add the access roles. — kwerle, Nov 15 '17 at 00:07

score 173 · Accepted Answer · edited Mar 16 '23 at 14:18

173

UPDATE (TL;DR)

There is now also an IAM Managed Policy named AWSLambdaRole that you can assign to your IAM user or IAM role. This should give you the permissions you need.

Original Answer

The AWSLambdaExecute and AWSLambdaBasicExecutionRole do not provide the permissions that are being expressed in the error. Both of these managed policies are designed to be attached to your Lambda function itself, so it runs with these policies.

The error is saying the user under which the nodejs program is running does not have rights to start the Lambda function.

You need to give your IAM user the lambda:InvokeFunction permission:

Find your User in the IAM Management Console and click it.
On the "Permissions" tab, expand the "Inline Policies" section and click the "click here" link to add a policy".
Select a "Custom Policy".
Give your policy a name. It can be anything.
Put this policy in the Policy Document field.

Sample policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1464440182000",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeAsync",
                "lambda:InvokeFunction"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

In this policy, I have included both methods to invoke lambda methods.

edited Mar 16 '23 at 14:18

Steve Chambers

37,270
24
156
208

answered May 28 '16 at 12:52

Matt Houser

33,983
6
70
88

3

This did not work for me, I had to use "lambda:*". In other words had to hit it with a big hammer! – Christopher Grigg Jun 30 '16 at 01:45
18

For what you are doing, there's no need to create a custom policy. You can add AWSLambdaRole as a managed policy on the user profile and that's it. – nunob Aug 18 '16 at 09:51
5

I tried both adding custom policy and attaching "AWSLambdaRole", but I am still getting the AccessDeniedException: is not authorized to perform: lambda:InvokeFunction – Jim Nov 08 '16 at 13:13
@lusocoding that worked for me, let me know if you post it as an answer of its own ;) – gdvalderrama Aug 08 '17 at 09:37
4

Works for me but it took some minutes to an hour before the changes took effect – kebbbnnn Jan 16 '20 at 01:13
1

AWSLambdaRole didn't work for me, i needed to create the inline policy with lambda:InvokeAsync, since i have event function types – Matt Fiocca May 20 '20 at 15:45
the Action "lambda:InvokeAsync" is deprecated, you just need the "lambda:InvokeFunction" – Jaime Marín Jun 12 '20 at 00:19
3

Adding `AWSLambdaRole` worked for me, but it took a few minutes to wait for it to work – Lafif Astahdziq Apr 24 '21 at 21:14
This is the perfect example of Amazon's trash UI. Or, to put it more clearly, why don't they just SAY this?! – Jared Alessandroni Jan 14 '23 at 20:49
WARNING: Using `"Resource": "*"` has given me a ton of trouble. better to use `"arn:aws:lambda:*:*:*"` instead – Asad-ullah Khan Feb 10 '23 at 20:14

score 21 · Answer 2 · edited Sep 03 '21 at 19:29

21

I'm using Serverless framework, and I had to also add arn:aws:lambda as a resource in my serverless.yml in order to use lambda.invoke.

 iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:DescribeTable
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
        - lambda:InvokeFunction # Added this like mentioned above
      Resource:
        - arn:aws:dynamodb:us-east-1:*:*
        - arn:aws:lambda:us-east-1:*:* # Had to add this too

edited Sep 03 '21 at 19:29

i_want_more_edits

131
6

answered Oct 16 '18 at 03:11

Jessica Bee

211
2
2

2

This solved the issue for me (none of the other answers worked for me). – Juan M. Molina Mar 16 '20 at 17:25
2

Thanks, this is what I was looking for. Just a note that this config should be put under the "provider" section, https://forum.serverless.com/t/generate-iam-permissions-for-invoking-lambda-from-lambda/338 – Anastasiia Solop Aug 23 '21 at 12:23
Not necessarily, it can be declared under the function yml definition as well in iamRoleStatements – androider Mar 22 '22 at 19:53

score 12 · Answer 3 · edited Sep 04 '21 at 03:18

This solution worked for me:

Attaching AWSKeyManagementServicePowerUser policy from the policy list (without that I got an error on "iam:listRole")
Adding lambda:ListFunctions to the custom policy defined by @Matt Houser

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1464440182000",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeAsync",
                "lambda:InvokeFunction"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

score 7 · Answer 4 · edited Sep 07 '21 at 05:55

7

Go to IAM, select the user and click on "add permissions". In the list of permission , you can simply search with all those policies with lambda,and check the ones you want in order to execute the lambda from console.

edited Sep 07 '21 at 05:55

Cadoiz

1,446
21
31

answered May 22 '18 at 03:18

mykey

1,943
19
13

score 4 · Answer 5 · answered Sep 19 '18 at 14:18

4

If you just use the policies that AWS provides you have to give to the user or the group it belongs

answered Sep 19 '18 at 14:18

Jherzon Franz Nava Rojas

83
6

Adding` AWSCodeDeploy` worked form me when calling Lambda from iOS. – Teodor Ciuraru Oct 21 '18 at 09:56

sharkdawg · Answer 6 · 2018-03-31T12:30:19.223

3

I solved this by adding the AWSLambdaFullAccess permissions to the user.

Within IAM Users, click add permissions
Select "Attach existing policies directly"
Search for AWSLambdaFullAccess, select it and click next:review at the bottom of the page.
Click Add Permissions

And that should do it.

edited Mar 31 '18 at 12:30

answered Mar 20 '18 at 17:40

sharkdawg

958
1
8
20

1

I had to add "AWSCodeDeployRoleForLambda" – Keith Norman Mar 27 '18 at 22:52
Agree with @KeithNorman, AWSLambdaFullAccess alone didn't do it for me. – dstudeba May 13 '19 at 03:20
1

note AWSLambdaFullAccess & AWSLambdaReadOnlyAccess are now deprecated. See here: https://docs.aws.amazon.com/lambda/latest/dg/security_iam_troubleshoot.html#security_iam_troubleshoot-admin-deprecation – mihaa123 Mar 29 '21 at 16:41

gildniy · Answer 7 · 2020-07-14T19:39:40.757

2

This worked for me:

{
    "Sid": "PermissionToInvoke",
    "Effect": "Allow",
    "Action": [
      "lambda:InvokeFunction"
    ],
    "Resource": "arn:aws:lambda:*:*:*:*"
}

edited Jul 14 '20 at 19:39

answered Jul 14 '20 at 19:31

gildniy

3,528
1
33
23

1

What is it about the Sid? Is this arbitrary? – Cadoiz Sep 07 '21 at 08:55
1

@Cadoiz You put a unique name in the Sid for identification of that permission from others – gildniy Sep 07 '21 at 08:57

score 0 · Answer 8 · answered Feb 16 '23 at 05:49

If you want to allow one lambda function to invoke another one you should update policies of your lambda role.

This is a Terraform example:

Set Up the IAM Roles and Policies:

resource "aws_iam_role" "lambda_1_role" {
    name   = "Lambda_1_Role"
    assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Effect": "Allow",
            "Sid": ""
        }
    ]
}
EOF
}

Add IAM Policy:

resource "aws_iam_policy" "iam_policy_for_lambda_1" {
    name         = "aws_iam_policy_for_terraform_aws_lambda_1_role"
    path         = "/"
    description  = "AWS IAM Policy for managing aws lambda 1 role"
    policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
        ],
        "Resource": "arn:aws:logs:*:*:*",
        "Effect": "Allow"
    },
    {
        "Sid": "Stmt1464440182000",
        "Effect": "Allow",
        "Action": [
            "lambda:InvokeAsync",
            "lambda:InvokeFunction"
        ],
        "Resource": [
            "*" 
        ]
    }
    ]
}
EOF
}

Don't forget to specify your Resource. Don't use the wildcard for production.

Attach IAM Policy to IAM Role:

resource "aws_iam_role_policy_attachment" "attach_iam_policy_to_iam_role_lambda_1" {
    role        = aws_iam_role.lambda_1_role.name
    policy_arn  = aws_iam_policy.iam_policy_for_lambda_1.arn
}

Create a lambda:

resource "aws_lambda_function" "lambda_1" {
    function_name  = "Lambda_1"
    filename       = "../lambda-1.zip"
    role           = aws_iam_role.lambda_1_role.arn
    handler        = "index.handler"
    runtime        = "nodejs16.x"
    depends_on     = [aws_iam_role_policy_attachment.attach_iam_policy_to_iam_role_lambda_1]
}

score 0 · Answer 9 · answered May 09 '23 at 21:37

For SAM templates, make sure you have added the lambda resource to your AppSync resource:

AppSyncApiServicePolicy:
Type: AWS::IAM::Policy
Properties:
  PolicyName: AppSyncLambdaInvokePolicy
  Roles:
    - !Ref AppSyncApiServiceRole
  PolicyDocument:
    Version: 2012-10-17
    Statement:
      - Effect: Allow
        Action: lambda:InvokeFunction
        Resource:
          - !GetAtt GetMessages.Arn // added lambda resource
          - !GetAtt SendMessage.Arn // added lambda resource

AccessDeniedException: User is not authorized to perform: lambda:InvokeFunction

9 Answers9

UPDATE (TL;DR)

Original Answer

Linked