Access denied error when creating lambda event source mapping with terraform

I have an existing DynamoDB table with stream enabled. I am trying to deploy a lambda function and add dynamodb as trigger using Terraform.

I started with restricted permissions and got AccessDenied error with aws_lambda_event_source_mapping. So I finally gave all the permissions on lambda and DynamoDB for that role, just for testing. But I am still getting access denied error.

Error creating Lambda event source mapping: AccessDeniedException

Lambda function is deployed successfully. I can confirm that stream_arn for dynamodb table is also accurate.

Here is my terraform script:

resource "aws_iam_role" "lambda_name_role" {
    name = "lambda_name_role-test"

   assume_role_policy = <<EOF
   {
       Version": "2012-10-17",
      "Statement": [
      {
          "Action": "sts:AssumeRole",
          "Principal": {
           "Service": "lambda.amazonaws.com"
          },
          "Effect": "Allow",
          "Sid": ""
      }
  ]
}
EOF
}

resource "aws_lambda_function" "lambda_function_name" {
  filename      = "./file.zip"
  function_name = "lambda-function-name-test"
  role          = aws_iam_role.lambda_name_role.arn
  handler       = "parse.handler"

  source_code_hash = filebase64sha256("./file.zip")
  memory_size      = 512
  timeout          = 10
  runtime          = "nodejs12.x"
}

resource "aws_iam_policy" "lambda_dynamodb_access" {
  name        = "lambda_dynamodb_access_policy_test"
  path        = "/"
  description = "IAM policy for DynamoDB access from lambda"

  policy = <<EOF
{
    "Version": "2012-10-17",
        "Statement": [
            {
                "Effect":"Allow",
                "Action": [
                    "dynamodb:*",
                    "lambda:*"
                ],
                "Resource":"*"
            }
        ]

}
EOF
}

resource "aws_iam_role_policy_attachment" "lambda_dynamodb_policy_attachment" {
  role       = aws_iam_role.lambda_name_role.name
  policy_arn = aws_iam_policy.lambda_dynamodb_access.arn
}

resource "aws_iam_role_policy_attachment" "lambda_cloudwatch_policy_attachment" {
  role       = aws_iam_role.aws_iam_role_policy_attachment.name
  policy_arn = var.cloudwatch_policy_arn
}

resource "aws_lambda_event_source_mapping" "lambda_trigger_dynamodb" {
  event_source_arn  = var.dynamodb_table_stream_arn
  function_name     = aws_lambda_function.lambda_function_name.arn
  starting_position = "LATEST"
}

Thank you for your help.

Update: I am able to reproduce this error using AWS CLI.

aws lambda create-event-source-mapping --event-source-arn <dynamodb-stream-arn> --function-name <lambda-function-arn> --enabled --starting-position LATEST

Received AccessDeniedException.

An error occurred (AccessDeniedException) when calling the CreateEventSourceMapping operation: User: <my-arn> is not authorized to perform: lambda:CreateEventSourceMapping on resource: * with an explicit deny

But I am able to add this mapping from AWS Console.

Access denied error when creating lambda event source mapping with terraform

0 Answers