Giving access to AWS Lambda service with limited policy

Question

I am trying to follow this tutorial to setup a lambda function to shutdown/startup instances with a special tag added to ec2 instances.

The policy assigned to my role by Admin user gives me access to all lambda function e.g by

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:*",
        "cognito-identity:ListIdentityPools",
        "cognito-sync:GetCognitoEvents",
        "cognito-sync:SetCognitoEvents",
        "dynamodb:*",
        "events:*",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:ListRoles",
        "iam:PassRole",
        "kinesis:DescribeStream",
        "kinesis:ListStreams",
        "kinesis:PutRecord",
        "lambda:*",
        "logs:*",
        "s3:*",
        "sns:ListSubscriptions",
        "sns:ListSubscriptionsByTopic",
        "sns:ListTopics",
        "sns:Subscribe",
        "sns:Unsubscribe"
      ],
      "Resource": "*"
    }
  ]
}

I am stuck as step 6 while setting Lambda function handler and role while selecting "Basic execution role" with error

User: arn:aws:iam::xxxx:user/Yyyy is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::xxxx:role/lambda_basic_exec

My role policy looked sth like this:

   {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
          ],
          "Resource": "arn:aws:logs:*:*:*"
        },       
        { 
          "Effect": "Allow",
          "Action": [
            "ec2:Describe*",
            "ec2:Start*",
            "ec2:RunInstances",
            "ec2:Stop*",
           ],
           "Resource": "*"
        }
      ]
    }

That seems reasonable given my limited rights.

What should I ask my Admin to update policy assigned to me, so I can successfully set scheduled event for lambda function as described in tutorial ? Or this can be done in some other way around using IAM e.g by adding new role ? I want only sufficient rights.

Tom Tom · Accepted Answer · 2016-01-22T13:08:38

you have a security constraint, as you would need the "iam:CreateRole" in your policy, along with something like "iam:attachRolePolicy" and "iam:createPolicy". So with that you would basically be admin of your account, as you could create roles with any policy and attach it to an EC2 instance or assume it directly.

What you could do is having your admin create one or several roles for lambda, e.g one for S3 access, one for ec2 commands etc. When you want then to create a lambda function, choose one of these pre-created roles instead of creating a new one.

Giving access to AWS Lambda service with limited policy

2 Answers

References