AWS AccessDeniedException for lambda ListFunctions on a IAM user

Viewed 8054

PRE-NOTE: I perform all of my AWS provisioning via a IAM-user console account that essentially has all of the privileges of the AWS/Amazon account owner. I'll call this IAM-user the root account.

Issue description:

  • From the root account I created the following IAM-user, with programmatic only access: lambda-test
  • I added it's IAM access keys (as a profile entry) in my ~/.aws/* files.
  • Now to that lambda-test account, I next created an Inline/Embedded policy that allows the following AWS-Lamdba operations: ListFunctions, GetFunction, UpdateFunctionCode, UpdateFunctionConfiguration

The policy statement -- which validated correctly -- looks like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1111111111111",  # <--- Altered for this post.
            "Effect": "Allow",
            "Action": [
                "lambda:GetFunction",
                "lambda:ListFunctions",
                "lambda:UpdateFunctionCode",
                "lambda:UpdateFunctionConfiguration"
            ],
            "Resource": [
                "arn:aws:lambda:*"
            ]
        }
    ]
}

Back at the laptop CLI, I issue the following command, which generates an AccessDeniedException:

user@linux$ aws lambda list-functions --profile lambda-test

Here is the exception:

An error occurred (AccessDeniedException) when calling the ListFunctions operation: User: arn:aws:iam::<AWS-Account-ID>:user/lambda-test is not authorized to perform: lambda:ListFunctions

Did I miss something? (Of course I did. =:)) Thanks in advance!

2 Answers

Not the OP's issue, but for others coming across this from Google:
Make sure you have Console sign-in enabled for the IAM user you are using. This can be set under IAM -> Users -> (select user) -> Security credentials

Related