AWS lambda AccessDeniedException calling another lambda function

Question

In my project i create a lambda function in python code that in one method have to call another lambda function using boto3. In my main lambda i create client like this:

client = boto3.client('lambda')

then i invoke my method in this fashion:

response = client.invoke(
            FunctionName='arn:aws:lambda:eu-west-1:1577:function:test',
            InvocationType='RequestResponse',
            LogType='None',
            Payload=json.dumps(d)
            )

but when i test my main lambda console return this error:

An error occurred (AccessDeniedException) when calling the Invoke operation: User

I try to set in my enviroment variables the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY but when i try to Save, return this error:

Lambda was unable to configure your environment variables because the environment variables you have provided contains reserved keys that are currently not supported for modification. Reserved keys used in this request: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY

How can i set in lambda a call using a IAM user?

Thanks in advance

Ashan · Accepted Answer · 2017-12-28 22:58:23Z

10

Instead of using an IAM user, attach the Lambda invoke permission to the existing IAM role attached to your parent Lambda function.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "InvokePermission",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction"
            ],
            "Resource": "*"
        }
    ]
}

Note: You can specify the ARN of the Lambda function that is being invoked for the Resource.

edited Dec 28, 2017 at 22:58

answered Dec 28, 2017 at 22:52

Ashan

19.7k5 gold badges53 silver badges69 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Peter Halverson · Accepted Answer · 2018-05-22 16:36:24Z

9

If possible, restrict the scope so the caller can only call your target function, vs the "*" resource which allows it to call any lambda function.

{
   "Version": "2012-10-17",
   "Statement": [
    {
        "Sid": "InvokePermission",
        "Effect": "Allow",
        "Action": [
            "lambda:InvokeFunction"
        ],
        "Resource": "arn:aws:lambda:eu-west-1:1577:function:test"
    }
  ]
}

answered May 22, 2018 at 16:36

Peter Halverson

4174 silver badges14 bronze badges

Collectives™ on Stack Overflow

AWS lambda AccessDeniedException calling another lambda function

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related