How to restrict AWS lambda access to only one role

user_14808811 0
Viewed 1120

I have created one lambda. I need to provide access to only one role that is created for this lambda i.e. only this role should have the invoke access. There may be other roles in account which may have invoke access on all lambdas but I want to restrict those roles not to access my lambda. Can anyone please suggest a way to achieve this behavior?

amazon-iam aws-lambda cloud amazon-web-services
1 Answers

A resource-based policy attached to a lambda function will work as Maurice commented.

Below is the sample policy. The action specified in the policy statement is explicitly denied to all principals except for the one specified. Only lambda_role is allowed to invoke testfunction lambda using the below resource-based policy.

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "0001",
      "Effect": "Deny",
      "NotPrincipal": {
        "AWS": "arn:aws:iam::659266464590:role/service-role/lambda_role"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:us-east-1:659266464590:function:testfunction"
    }
  ]
}
user_54683640
Related