Call Lambda using CustomResource

Question

I created a CustomResource to call a lambda function when the CloudFormation stack is created. It fails with the following error:

 Received response status [FAILED] from custom resource. Message returned: User: arn:aws:sts::<account>:assumed-role/stack-role is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-east-1:<account>:function:<lambda> because no identity-based policy allows the lambda:InvokeFunction action

This is the code in the CDK:

import * as cr from '@aws-cdk/custom-resources';

const callLambda = new cr.AwsCustomResource(this, 'MyCustomResource', {
        onCreate: {
            service: 'Lambda',
            action: 'invoke',
            region: 'us-east-1',
            physicalResourceId: cr.PhysicalResourceId.of(Date.now.toString()),
            parameters: {
                FunctionName: `my-function`,
                Payload: '{}'
            }, 
        },
        policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
            resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
        })
    });

How can I grant permissions to the stack's assumed role so that it can perform lambda:InvokeFunction?

Pharmakon · Accepted Answer · 2021-11-12 03:05:21Z

2

I solved the issue by creating a role that assumes the lambda service principal, and adding a policy statement allowing the lambda:InvokeFunction.

import * as cr from '@aws-cdk/custom-resources';
import * as iam from "@aws-cdk/aws-iam";

let role = new iam.Role(this, `my-role`, {
        assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
    });
    role.addToPolicy(new iam.PolicyStatement({
        effect: iam.Effect.ALLOW,
        actions: ['lambda:InvokeFunction'],
        resources: ['*']
    }));
    
const callLambda = new cr.AwsCustomResource(this, 'MyCustomResource', {
    onCreate: {
        service: 'Lambda',
        action: 'invoke',
        region: 'us-east-1',
        physicalResourceId: cr.PhysicalResourceId.of(Date.now.toString()),
        parameters: {
            FunctionName: `my-function`,
            Payload: '{}'
        }, 
    },
    policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
        resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
    }),
    role: role as any
});

answered Nov 12, 2021 at 3:05

Pharmakon

1782 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

user2809286 Over a year ago

Worked for me. No need to cast role as any.

vicecarloans · Accepted Answer · 2022-10-13 15:28:00Z

1

I find fromStatements works...must be some issues with fromSdkCalls

new cr.AwsCustomResource(this, 'MyCustomResource', {
        onCreate: {
            service: 'Lambda',
            action: 'invoke',
            region: 'us-east-1',
            physicalResourceId: cr.PhysicalResourceId.of(Date.now.toString()),
            parameters: {
                FunctionName: `my-function`,
                Payload: '{}'
            }, 
        },
        policy: cr.AwsCustomResourcePolicy.fromStatements([
          new PolicyStatement({
            effect: Effect.ALLOW,
            actions: ["lambda:InvokeFunction"],
            resources: ["*"],
          }),
        ])
    });

edited Oct 13, 2022 at 15:28

answered Oct 13, 2022 at 15:27

vicecarloans

112 bronze badges

Comments

fedonev · Accepted Answer · 2021-11-11 21:19:49Z

0

Add a ResourcePolicy to your construct.

// infer the required permissions; fine-grained controls also available
policy: AwsCustomResourcePolicy.fromSdkCalls({resources: AwsCustomResourcePolicy.ANY_RESOURCE})

answered Nov 11, 2021 at 21:19

fedonev

26.1k2 gold badges43 silver badges60 bronze badges

1 Comment

Pharmakon Over a year ago

Thanks for the comment. I already had that statement in the code, I accidentally omitted it when consolidating and sanitizing. The error occurs with the policy defined.

Collectives™ on Stack Overflow

Call Lambda using CustomResource

3 Answers 3

1 Comment

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related