AWS lambda AccessDeniedException calling another lambda function

5
votes

In my project i create a lambda function in python code that in one method have to call another lambda function using boto3. In my main lambda i create client like this:

client = boto3.client('lambda')

then i invoke my method in this fashion:

response = client.invoke(
            FunctionName='arn:aws:lambda:eu-west-1:1577:function:test',
            InvocationType='RequestResponse',
            LogType='None',
            Payload=json.dumps(d)
            )

but when i test my main lambda console return this error:

An error occurred (AccessDeniedException) when calling the Invoke operation: User

I try to set in my enviroment variables the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY but when i try to Save, return this error:

Lambda was unable to configure your environment variables because the environment variables you have provided contains reserved keys that are currently not supported for modification. Reserved keys used in this request: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY

How can i set in lambda a call using a IAM user?

Thanks in advance

2
pythonamazon-web-servicesaws-lambdaboto3amazon-iam

2 Answers

7
votes

Instead of using an IAM user, attach the Lambda invoke permission to the existing IAM role attached to your parent Lambda function.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "InvokePermission",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction"
            ],
            "Resource": "*"
        }
    ]
}

Note: You can specify the ARN of the Lambda function that is being invoked for the Resource.

6
votes

If possible, restrict the scope so the caller can only call your target function, vs the "*" resource which allows it to call any lambda function.

{
   "Version": "2012-10-17",
   "Statement": [
    {
        "Sid": "InvokePermission",
        "Effect": "Allow",
        "Action": [
            "lambda:InvokeFunction"
        ],
        "Resource": "arn:aws:lambda:eu-west-1:1577:function:test"
    }
  ]
}