AWS SAM AccessDeniedException on a Lambda that uses the AWS SDK

Question

I have an AWS Lambda function in Node.js that uses the SDK method listVersionsByFunction.

It's created from this AWS SAM template:

AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Globals: Function: Timeout: 3 Resources: special: Type: AWS::Serverless::Function Properties: FunctionName: 'my-project-special' CodeUri: ./handlers Handler: special.handler Runtime: nodejs10.x getLatest: Type: AWS::Serverless::Function Properties: CodeUri: ./handlers Handler: getLatest.handler Runtime: nodejs10.x Events: getLatest: Type: Api Properties: Path: /latest/ Method: get

and the handler calls the SDK like this:

const result = await lambda.listVersionsByFunction({ FunctionName: 'my-project-special', }).promise();

After deploying and making a request, there's an AccessDeniedException error:

User: arn:aws:sts::999999999:assumed-role/my-project-getLatest-ADFADSFASD/my-project-getLatest-HJLKHLKJKJ is not authorized to perform: lambda:ListVersionsByFunction on resource: arn:aws:lambda:us-east-2:999999999:function:my-project-special

How can I allow this access by means of the AWS SAM template?

Assael Azran · Accepted Answer · 2019-11-13 12:22:25Z

The error is indicating that your Lambda does not have permission to perform ListVersionsByFunctionoperation on other resources (another Lambda).

What you have to do is to create a custom policy and add it to your template.

getLatest: Type: AWS::Serverless::Function Properties: CodeUri: ./handlers Handler: getLatest.handler Runtime: nodejs10.x Policies: - Version: '2012-10-17' Statement: - Effect: Allow Action: - lambda:ListVersionsByFunction Resource: '*' Events: getLatest: Type: Api Properties: Path: /latest/ Method: get

See reference

Or you can also add this policy as inline policy in IAM Management Console, under Roles select your function getLatest and add the policy. see snapshot.

Hope it helps

Collectives™ on Stack Overflow

AWS SAM AccessDeniedException on a Lambda that uses the AWS SDK

1 Answer 1

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Related