Unable to add trigger to AWS Lambda

Question

I am trying to add SQS as a trigger to my Lambda function running in AWS-VPC but it throws error as :

An error occurred when creating the trigger: The provided execution role does not have permissions to call ReceiveMessage on SQS (Service: AWSLambda; Status Code: 400; Error Code: InvalidParameterValueException; Request ID: d34b7525-5c69-4434-a015-112e8e74f447; Proxy: null)

Tried via adding AWSLambdaVPCAccessExecutionRole to the policy for the role as well via IAM. But no luck!

I am unable to figure where I am making a mistake? Please help me out, if anyone had similar experience in past or knows how to resolve it. Thanks you in advance!

You need to add access for sqs in you role. The policy that you mentioned can provide access to vpc resources only. SQS is another managed service. — Sangam Belose
– Sangam Belose, Commented Jul 21, 2020 at 11:09

Sangam Belose · Accepted Answer · 2020-07-21 11:20:00Z

14

Please attach managed policy AWSLambdaSQSQueueExecutionRole in your lambda execution role. If your lambda function is working with any other aws services, you can try creating custom role and add specific permissions.

In aws if any service want to access any another service you need those specific permission in role.

for more information on lambda permission please check Managed lambda permissions

edited Jul 21, 2020 at 11:20

answered Jul 21, 2020 at 11:13

Sangam Belose

4,5228 gold badges29 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Amit kumar Over a year ago

I have these policies : AWSLambdaSQSQueueExecutionRole and AWSLambdaVPCAccessExecutionRole already added. But doesn't works!

serfer2 Over a year ago

@Amitkumar maybe you also need to add AWSLambdaBasicExecutionRole it worked for me by adding these three roles

charlie10 · Accepted Answer · 2020-07-21 11:14:56Z

7

You need to add the following actions to the IAM Role attached to your lambda:

sqs:ReceiveMessage
sqs:DeleteMessage
sqs:GetQueueAttributes

Otherwise your lambda will not be able to receive any message from the queue. DeleteMessage action allows to remove a message from queue once its successfully processed. As a resource set the ARN of your SQS queue. Policy should look like this:

{
    "Action": [
        "sqs:DeleteMessage",
        "sqs:ReceiveMessage",
        "sqs:GetQueueAttributes"
    ],
    "Resource": "arn:aws:sqs:region:accountid:queuename",
    "Effect": "Allow"
}

If you're looking for a managed policy, have a look at AWSLambdaSQSQueueExecutionRole.

answered Jul 21, 2020 at 11:14

charlie10

712 bronze badges

Comments

AWS PS · Accepted Answer · 2020-07-21 11:16:00Z

Attach a policy for a lambda role you might have to change account_number to your account no if you need to invoke another lambda form this lambda

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "",
        "Effect": "Allow",
        "Action": "lambda:InvokeFunction",
        "Resource": "arn:aws:lambda:**eu-west-1**:**account_number:function**:*"
    },
    {
        "Sid": "",
        "Effect": "Allow",
        "Action": [
            "logs:PutLogEvents",
            "logs:CreateLogStream",
            "logs:CreateLogGroup"
        ],
        "Resource": "*"
    },
    {
        "Sid": "",
        "Effect": "Allow",
        "Action": [
            "sqs:*"
        ],
        "Resource": "*"
    }
]
}

Collectives™ on Stack Overflow

Unable to add trigger to AWS Lambda

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related