Viewing resource-based IAM policies in Lambda

To view a function's resource-based policy

1. Open the Functions page of the Lambda console.

2. Choose a function.

3. Choose Configuration and then choose Permissions.

4. Scroll down to Resource-based policy and then choose View policy document. The resource-based policy shows the permissions that are applied when another account or AWS service attempts to access the function. The following example shows a statement that allows Amazon S3 to invoke a function named my-function for a bucket named amzn-s3-demo-bucket in account 123456789012.

   Example resource-based policy

   {
    "Version":"2012-10-17",
    "Id": "default",
    "Statement": [
    {
    "Sid": "lambda-allow-s3-my-function",
    "Effect": "Allow",
    "Principal": {
    "Service": "s3.amazonaws.com"
    },
    "Action": "lambda:InvokeFunction",
    "Resource": "arn:aws:lambda:us-east-2:123456789012:function:my-function",
    "Condition": {
    "StringEquals": {
    "AWS:SourceAccount": "123456789012"
    },
    "ArnLike": {
    "AWS:SourceArn": "arn:aws:s3:::amzn-s3-demo-bucket"
    }
    }
    }
    ]
   }
   

{"Version":"2012-10-17","Id":"default","Statement":[{"Sid":"sns","Effect":"Allow","Principal":{"Service":"s3.amazonaws.com"},"Action":"lambda:InvokeFunction","Resource":"arn:aws:lambda:us-east-2:123456789012:function:my-function","Condition":{"ArnLike":{"AWS:SourceArn":"arn:aws:sns:us-east-2:123456789012:lambda*"}}}]}