Working with AWS managed policies in the execution role
The following AWS managed policies provide permissions that are required to use Lambda features.
| Change | Description | Date |
|---|---|---|
|
AWSLambdaMSKExecutionRole – Lambda added the kafka:DescribeClusterV2 permission to this policy. |
|
June 17, 2022 |
|
AWSLambdaBasicExecutionRole – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
|
AWSLambdaDynamoDBExecutionRole – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
|
AWSLambdaKinesisExecutionRole – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
|
AWSLambdaMSKExecutionRole – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
|
AWSLambdaSQSQueueExecutionRole – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
|
AWSLambdaVPCAccessExecutionRole – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
|
AWSXRayDaemonWriteAccess – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
|
CloudWatchLambdaInsightsExecutionRolePolicy – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
|
AmazonS3ObjectLambdaExecutionRolePolicy – Lambda started tracking changes to this policy. |
|
February 14, 2022 |
For some features, the Lambda console attempts to add missing permissions to your execution role in a customer managed policy. These policies can become numerous. To avoid creating extra policies, add the relevant AWS managed policies to your execution role before enabling features.
When you use an event source mapping to invoke your function, Lambda uses the execution role to read event data. For example, an event source mapping for Kinesis reads events from a data stream and sends them to your function in batches.
When a service assumes a role in your account, you can include the aws:SourceAccount and aws:SourceArn global
condition context keys in your role trust policy to limit access to the role to only requests that are generated by expected resources. For more
information, see Cross-service
confused deputy prevention for AWS Security Token Service.
In addition to the AWS managed policies, the Lambda console provides templates for creating a custom policy with permissions for additional use cases. When you create a function in the Lambda console, you can choose to create a new execution role with permissions from one or more templates. These templates are also applied automatically when you create a function from a blueprint, or when you configure options that require access to other services. Example templates are available in this guide's GitHub repository.
Warning Javascript is disabled or is unavailable in your browser.
To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.