lambda:InvokeFunction Not Working with All Resources Set

Question

I am working on an access policy for one of my user roles that I am using to run a Lambda function. I have this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:*:*:*"
        },
        {
            "Effect": "Allow",
            "Action": "lambda:InvokeFunction",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeInstances",
            "Resource": "*"
        }
    ]
}

I understand that setting my resources to * is not best practice but I'm just trying to get it working before I narrow in on the most locked down version of it.

When I test my lambda function it says this:

ClientError: An error occurred (AccessDeniedException) when calling the Invoke operation: User: arn:aws:sts::{NUMBERS}:assumed-role/{ROLE_NAME}/awslambda_{NUMBERS}_{NUMBERS} is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-east-1:{NUMBERS}:function:{FUNCTION_NAME}

I've obviously obscured some of it above with the curly braces and words but the ROLE_NAME above matches the role name that I'm editing the policy for. I'm not sure why it would fail. I've tried as the resource something like on of these:

arn:aws:lambda:*:*:*:*
arn:aws:lambda:*:*:*

Those don't work. So I've tried very broad, I've tried to narrow in on it and nothing is working. Is there something else I have to do to get those to stick? I have the IAM policy window open on one screen and lambda on the other so I'm testing right after I update the policy but I've also completely logged out and logged back in to see if there was something with that. That didn't fix it.

Any ideas?

Answer 1

I did this a while back. It's from my notes. Of course the account check is still there.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": ["lambda:InvokeFunction"],
      "Effect": "Allow",
      "Resource": "arn:aws:lambda:*:*:*"
    }
  ]
}

You can also try the IAM Policy Simulator page in AWS console. You can pick and choose actions and resources and see if it goes through. The explanation sometimes is kludgy at first glance, but it's helpful.