aws.amazon.com/about-aws/…/aws-lambda-full-iam-resource-based-policiesThis security improvement lets you edit a Lambda function's resource-based policy. Before, you had to call the
lambda:AddPermission API method to add single statements, and all those did was
Allow specific principals to
lambda:InvokeFunction . For an analogy, compare the expressiveness of security group rules (allow only) and Network Access Control List rules (allow or deny).
CloudFormation:
AWS::Lambda::Permission →
AWS::Lambda::ResourcePolicyTerraform:
aws_lambda_permission →
aws_lambda_policy (
proposed in
terraform-provider-aws issue
49691 ; not implemented as of
v6.62 ; you could use
terraform-provider-awscc for now)
Benefits:
• You can use IAM condition keys to intelligently target principals that can invoke a Lambda function.
• You can make permission to invoke a Lambda function
exclusive (for example, exclusive to the event source mapping from one particular SQS queue) by adding a
Deny statement to complement an
Allow statement in the same resource policy or in an identity-based (IAM user or role) policy. Before, you would have needed a Service Control Policy to prevent unintended IAM users and roles from invoking particular Lambda functions.
Exclusive permission to invoke a Lambda function is now practical, but I need to check whether old restrictions on role trust (assume role) policies for the Lambda service have been relaxed so it's practical to make an IAM role exclusive to a Lambda function.
