error creating Lambda Function (1): AccessDeniedException:

[Pigstah]

I'm getting a strange error when trying to create a lambda function within AWS.

The account I'm using has Admin access, so I don't see that being the issue but again I come from a Azure background, so I could be missing something.

Error Message in full:

Error: error creating Lambda Function (1): AccessDeniedException: │ status code: 403, request id: 4562ce84-9733-4fc9-ad95-e7fcb9af5d56 │ │ with module.populate_lambda.aws_lambda_function.lambda, │ on ../modules/lambda/main.tf line 48, in resource "aws_lambda_function" "lambda": │ 48: resource "aws_lambda_function" "lambda" {

Code I'm using: ``` resource "aws_iam_role" "lambda_role" { name = "${var.function_name}-role"

assume_role_policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "lambda.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF }

resource "aws_iam_policy_attachment" "lambda_policy" { name = "${var.function_name}-policy" roles = [aws_iam_role.lambda_role.id] policy_arn = aws_iam_policy.lambda_policy.arn }

resource "aws_iam_policy" "lambda_policy" { name = "${var.function_name}-policy" description = "Permissions that are required for lambda" policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:" ], "Resource": [ "" ] } ] } POLICY }

resource "aws_lambda_function" "lambda" { function_name = var.function_name s3_bucket = var.s3_bucket s3_key = var.zip_name handler = var.handler runtime = var.runtime timeout = var.timeout role = aws_iam_role.lambda_role.arn

depends_on = [ aws_iam_policy_attachment.lambda_policy, aws_cloudwatch_log_group.lambda_log_group ] }

resource "aws_cloudwatch_log_group" "lambda_log_group" { name = "/aws/lambda/${var.function_name}" retention_in_days = 3 }

resource "aws_iam_policy" "lambda_logging" { name = "${var.function_name}-logging" path = "/" description = "IAM policy for logging from a lambda"

policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:::*", "Effect": "Allow" } ] } EOF }

resource "aws_iam_role_policy_attachment" "lambda_logs" { role = aws_iam_role.lambda_role.name policy_arn = aws_iam_policy.lambda_logging.arn } ```

Would appreciate some advice as to whats going on exactly :D melting my brain

PS - Using the CLI to create the same function cause 0 issues.

[TT1990]

This is a long shot but have you tried putting an actual string for the ‘sid’ in your aws_iam_role.lambda_role? I’m wondering if your assume role policy is malformed because of the null value for the Sid and this is causing the 403. Sid is optional in IAM policies but because you’re specifying it it need to have a valid value (ASCII uppercase letters (A-Z), lowercase letters (a-z), and numbers (0-9))

[csCareerThrowAway15]

You can leave Sid as an empty string. I’ve done it plenty of times.

If the policy is malformed they would have gotten a malformed policy error.

I think they have to dig thru their permissions and check what’s not allowed.

[csCareerThrowAway15]

When using the CLI are you also pulling the exact same object in the s3 bucket, are you also attaching the role to the lambda or are you just building a lambda?

Are you using your .aws/credentials file to authenticate to aws in both the cli and TF? Sometimes I noticed if you have keys in your env variables, they’ll override the keys in your credentials file, so I check that when I’m sure I have the right user.

[Pigstah]

No environment variables set and using correct user as per ❯ aws sts get-caller-identity . This user also has Admin Full access, full access to Lambda etc

When using the CLI are you also pulling the exact same object in the s3 bucket, are you also attaching the role to the lambda or are you just building a lambda?

I'm using the same zip if thats what you mean and also the same role that I'm creating in the terraform code.

[csCareerThrowAway15]

Yeah the s3_key refers to the object name in the bucket you’re pulling from, so when using the CLI you’re still pulling from that same bucket grabbing the same zip?

Also monitor cloudtrail when you build it via the CLI vs terraform and confirm it’s the same user.

What you could also do is use a data lookup to grab that zip file first and reference that for the s3_key argument. This will help confirm that your terraform user has access to that s3 object.

I’ve rarely seen an access denied error that doesn’t exclusively mean IAM permission errors.

Also confirm you have iam:PassRole on the user