Skip to content

Instantly share code, notes, and snippets.

@dreamorosi
Last active April 7, 2021 16:10
Show Gist options
  • Save dreamorosi/fb8cc4eb23a4cc1a39c08662ab412b65 to your computer and use it in GitHub Desktop.
Save dreamorosi/fb8cc4eb23a4cc1a39c08662ab412b65 to your computer and use it in GitHub Desktop.
AWS Role that allows to access, create and run and develop lambda functions through the Console, allows to use only a specific execution role for the function, good for training sessions.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadOnlyPermissions",
"Effect": "Allow",
"Action": [
"lambda:GetAccountSettings",
"lambda:ListFunctions",
"lambda:ListTags",
"lambda:GetEventSourceMapping",
"lambda:ListEventSourceMappings",
"iam:ListRoles"
],
"Resource": "*"
},
{
"Sid": "DevelopFunctions",
"Effect": "Allow",
"NotAction": [
"lambda:AddPermission",
"lambda:PutFunctionConcurrency"
],
"Resource": "arn:aws:lambda:*:*:function:*"
},
{
"Sid": "DevelopEventSourceMappings",
"Effect": "Allow",
"Action": [
"lambda:DeleteEventSourceMapping",
"lambda:UpdateEventSourceMapping",
"lambda:CreateEventSourceMapping"
],
"Resource": "*",
"Condition": {
"StringLike": {
"lambda:FunctionArn": "arn:aws:lambda:*:*:function:*"
}
}
},
{
"Sid": "PassExecutionRole",
"Effect": "Allow",
"Action": [
"iam:ListRolePolicies",
"iam:ListAttachedRolePolicies",
"iam:GetRole",
"iam:PassRole"
],
"Resource": "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
},
{
"Sid": "ViewExecutionRolePolicies",
"Effect": "Allow",
"Action": [
"iam:GetPolicy",
"iam:GetPolicyVersion"
],
"Resource": "arn:aws:iam::aws:policy/*"
},
{
"Sid": "ViewLogs",
"Effect": "Allow",
"Action": [
"logs:*"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*"
},
{
"Sid": "UseKeys",
"Effect": "Allow",
"Action": [
"kms:listKeys",
"kms:listAliases",
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*"
],
"Resource": "*"
},
{
"Sid": "ListTags",
"Effect": "Allow",
"Action": [
"tag:getResources"
],
"Resource": "*"
}
]
}
@StanSilas
Copy link

      "Sid": "ViewExecutionRolePolicies",
        "Resource": "arn:aws:iam::aws:policy/*"

is wrong/ invalid.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment