aws lambda update-function-configuration receives AccessDeniedException

Question

I want to grant vpc access for my lambda function. I use the following aws cli command.

aws lambda update-function-configuration \
--function-name SampleFunction \
--vpc-config SubnetIds=subnet-xxxx,SecurityGroupIds=sg-xxxx

But I receive the following error:

An error occurred (AccessDeniedException) when calling the UpdateFunctionConfiguration operation: Your access has been denied by EC2, please make sure your request credentials have permission to DescribeSecurityGroups for sg-xxxx. EC2 Error Code: UnauthorizedOperation. EC2 Error Message: You are not authorized to perform this operation.

I have granted the following permission to both my lambda role and the user who execute the aws command.

    - "ec2:CreateNetworkInterface"
    - "ec2:DescribeNetworkInterfaces"
    - "ec2:DeleteNetworkInterface"
    - "ec2:DescribeSecurityGroups"

I further tried to grant full access to both the lambda role and the user. But still received the same error

Can anyone suggest what else I can try?

Answer 1

The trick is to add the pipeline / worker role / user which is deploying the lambda function) have access to network related policies. The lambda function should itself suffice with managed policy - AWSLambdaVPCAccessExecutionRole

arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole

Action:
  - ec2:DescribeSecurityGroups
  - ec2:DescribeSubnets
  - ec2:DescribeVpcs
Effect: Allow
Resource: '*'

Answer 2

Your users IAM policy needs further permissions.

For example ec2:CreateSecurityGroup & etc. Have a look at this documentation to add requred permissions.