Why does Lambda need permissions to complete lifecycle hooks?

user_422941 0
Viewed 97

From the AWS tutorial page on configuring a lifecycle hook:

Before you create a Lambda function, you must first create an execution role and a permissions policy to allow Lambda to complete lifecycle hooks.

What is risky or special about completing lifecycle hooks that permissions are needed?

I can't see what is qualitatively different from anything else we configure in EC2. Everything is risky, but we don't need to set roles and permissions.

amazon-iam aws-lambda amazon-web-services
1 Answers

"completing lifecycle hooks" is actually an API call that your lambda should execute against your ASG:

So your lambda execution role must have permissions to perform such an action. For example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "autoscaling:CompleteLifecycleAction",
            "Resource": "*"
        }
    ]
}
user_2488230
Related