AWS managed policies for AWS Lambda

An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.

For more information, see AWS managed policies in the IAM User Guide.

AWS managed policy: AWSLambda_FullAccess

This policy grants full access to Lambda actions. It also grants permissions to other AWS services that are used to develop and maintain Lambda resources.

You can attach the AWSLambda_FullAccess policy to your users, groups, and roles.

Permissions details

This policy includes the following permissions:

• lambda – Allows principals full access to Lambda.

• cloudformation – Allows principals to describe AWS CloudFormation stacks and list the resources in those stacks.

• cloudwatch – Allows principals to list Amazon CloudWatch metrics and get metric data.

• ec2 – Allows principals to describe security groups, subnets, and VPCs.

• iam – Allows principals to get policies, policy versions, roles, role policies, attached role policies, and the list of roles. This policy also allows principals to pass roles to Lambda. The PassRole permission is used when you assign an execution role to a function.

• kms – Allows principals to list aliases.

• logs – Allows principals to describe Amazon CloudWatch log groups. For log groups that are associated with a Lambda function, this policy allows the principal to describe log streams, get log events, and filter log events.

• states – Allows principals to describe and list AWS Step Functions state machines.

• tag – Allows principals to get resources based on their tags.

• xray – Allows principals to get AWS X-Ray trace summaries and retrieve a list of traces specified by ID.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambda_FullAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambda_ReadOnlyAccess

This policy grants read-only access to Lambda resources and to other AWS services that are used to develop and maintain Lambda resources.

You can attach the AWSLambda_ReadOnlyAccess policy to your users, groups, and roles.

Permissions details

This policy includes the following permissions:

• lambda – Allows principals to get and list all resources.

• cloudformation – Allows principals to describe and list AWS CloudFormation stacks and list the resources in those stacks.

• cloudwatch – Allows principals to list Amazon CloudWatch metrics and get metric data.

• ec2 – Allows principals to describe security groups, subnets, and VPCs.

• iam – Allows principals to get policies, policy versions, roles, role policies, attached role policies, and the list of roles.

• kms – Allows principals to list aliases.

• logs – Allows principals to describe Amazon CloudWatch log groups. For log groups that are associated with a Lambda function, this policy allows the principal to describe log streams, get log events, and filter log events.

• states – Allows principals to describe and list AWS Step Functions state machines.

• tag – Allows principals to get resources based on their tags.

• xray – Allows principals to get AWS X-Ray trace summaries and retrieve a list of traces specified by ID.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambda_ReadOnlyAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaBasicExecutionRole

This policy grants permissions to upload logs to CloudWatch Logs.

You can attach the AWSLambdaBasicExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaBasicExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaDynamoDBExecutionRole

This policy grants permissions to read records from an Amazon DynamoDB stream and write to CloudWatch Logs.

You can attach the AWSLambdaDynamoDBExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaDynamoDBExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaENIManagementAccess

This policy grants permissions to create, describe, and delete elastic network interfaces used by a VPC-enabled Lambda function.

You can attach the AWSLambdaENIManagementAccess policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaENIManagementAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaExecute

This policy grants PUT and GET access to Amazon Simple Storage Service and full access to CloudWatch Logs.

You can attach the AWSLambdaExecute policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaExecute in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaInvocation-DynamoDB

This policy grants read access to Amazon DynamoDB Streams.

You can attach the AWSLambdaInvocation-DynamoDB policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaInvocation-DynamoDB in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaKinesisExecutionRole

This policy grants permissions to read events from an Amazon Kinesis data stream and write to CloudWatch Logs.

You can attach the AWSLambdaKinesisExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaKinesisExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaMSKExecutionRole

This policy grants permissions to read and access records from an Amazon Managed Streaming for Apache Kafka cluster, manage elastic network interfaces, and write to CloudWatch Logs.

You can attach the AWSLambdaMSKExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaMSKExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaRole

This policy grants permissions to invoke Lambda functions.

You can attach the AWSLambdaRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaSQSQueueExecutionRole

This policy grants permissions to read and delete messages from an Amazon Simple Queue Service queue, and grants write permissions to CloudWatch Logs.

You can attach the AWSLambdaSQSQueueExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaSQSQueueExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaVPCAccessExecutionRole

This policy grants permissions to manage elastic network interfaces within an Amazon Virtual Private Cloud and write to CloudWatch Logs.

You can attach the AWSLambdaVPCAccessExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaVPCAccessExecutionRole in the AWS Managed Policy Reference Guide.

Lambda updates to AWS managed policies

Change	Description	Date
AWSLambdaVPCAccessExecutionRole – Change	Lambda updated the AWSLambdaVPCAccessExecutionRole policy to allow the action ec2:DescribeSubnets.	January 5, 2024
AWSLambda_ReadOnlyAccess – Change	Lambda updated the AWSLambda_ReadOnlyAccess policy to allow principals to list AWS CloudFormation stacks.	July 27, 2023
AWS Lambda started tracking changes	AWS Lambda started tracking changes for its AWS managed policies.	July 27, 2023