View a markdown version of this page

AWS::Lambda::ResourcePolicy - AWS CloudFormation
SyntaxPropertiesReturn valuesExamples

This is the new CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.

AWS::Lambda::ResourcePolicy

Use the AWS::Lambda::ResourcePolicy resource to attach a resource-based policy to a Lambda resource. A resource-based policy applies to a single Lambda resource, for example, a function, function version, or function alias. To learn more about using resource-based policies with Lambda, see Working with resource-based policies in Lambda in the AWS Lambda Developer Guide.

You can use resource-based policies to grant permissions to other AWS services, AWS accounts and organizations, and IAM users and roles to access your Lambda resource. You can also deny access to specific entities, and use the full range of IAM global condition keys to further restrict who has access to your Lambda resource. For example, you can limit access to calls originating from a specified IP address or Amazon VPC.

A resource-based policy is a JSON document containing a number of statements. Each statement defines the entities you want to grant permission to, the API actions you want to allow or deny, and the Lambda resource you want the statement to apply to. A statement can also optionally include an array of logical conditions using the IAM global condition keys.

To use the AWS::Lambda::ResourcePolicy resource, make sure that you have the resource-based policy permissions for Lambda.

To learn more about creating resource-based policies, see Policies and permissions in AWS Identity and Access Management in the AWS Identity and Access Management User Guide. For more information about example policies for providing permissions to AWS services, other AWS accounts, and IAM users and roles, see Example resource-based policies for Lambda functions in the AWS Lambda Developer Guide.

Avoid mixing permission resource types

To grant permissions to access your function, we recommend using the AWS::Lambda::ResourcePolicy resource to set access permissions. With this resource, you have more flexibility and fine-grained control than AWS::Lambda::Permission. This resource grants an AWS service or another account permission to call a particular API action on a function.

You can also use the AWS::Lambda::Permission resource, however using both AWS::Lambda::Permission and AWS::Lambda::ResourcePolicy to set permissions on a function can result in errors. Permissions defined in AWS::Lambda::Permission can be unintentionally overwritten, whether in a single CloudFormation stack or across multiple stacks. Don't use both resource types to set permissions on a function.

To migrate existing permissions for a function from AWS::Lambda::Permission to AWS::Lambda::ResourcePolicy, do the following:

  1. Set a Retaindeletion policy on the AWS::Lambda::Permission resources you want to migrate. This is necessary so that Lambda does not delete statements with the same statement ID when you delete these resources.

  2. Use the GetResourcePolicyLambda API to retrieve the resource-based policy currently attached to the function.

  3. Use this policy to create a new AWS::Lambda::ResourcePolicy resource.

  4. Delete all the existing AWS::Lambda::Permission resources for the function.

Syntax

To declare this entity in your CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::Lambda::ResourcePolicy",
  "Properties" : {
      "PolicyDocument" : Json,
      "ResourceArn" : String
    }
}

YAML

Type: AWS::Lambda::ResourcePolicy
Properties:
  PolicyDocument: Json
  ResourceArn: String

Properties

PolicyDocument

The policy document you want to add to your Lambda resource. This is formatted as a JSON string.

For more information, see Working with resource-based policies in Lambda in the AWS Lambda Developer Guide.

Required: Yes

Type: Json

Update requires: No interruption

ResourceArn

The Amazon Resource Name (ARN) of the Lambda resource you want to add the policy to. For a function, you can use a qualified or an unqualified ARN. The value must be a complete ARN, and the operation does not accept wildcard characters.

Required: Yes

Type: String

Pattern: ^(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\$LATEST(\.PUBLISHED)?|[a-zA-Z0-9-_]+))?$

Minimum: 12

Maximum: 1024

Update requires: Replacement

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the primary ID of the resource (ResourceArn)

For more information about using the Ref function, see Ref.

Examples

Grant invoke permission to another AWS account

The following example templates attach an IAM policy to a Lambda function using the PolicyDocument property that allows the function to be invoked by another AWS account.

For more information about example resource-based policies for a variety of use cases, see Working with resource-based IAM policies in Lambda in the AWS Lambda Developer Guide.

JSON

"LambdaResourcePolicy": {
    "Type": "AWS::Lambda::ResourcePolicy",
    "Properties": {
        "ResourceArn": "arn:aws:lambda:us-east-2:123456789012:function:my-function",
        "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "Statement1",
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::111122223333:root"
                    },
                    "Action": "lambda:InvokeFunction",
                    "Resource": "arn:aws:lambda:us-east-2:123456789012:function:my-function"
                }
            ]
        }
    }
}

YAML

LambdaResourcePolicy:
  Type: AWS::Lambda::ResourcePolicy
  Properties:
    ResourceArn: arn:aws:lambda:us-east-2:123456789012:function:my-function
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
      - Sid: Statement1
        Effect: Allow
        Principal:
          AWS: arn:aws:iam::111122223333:root
        Action: lambda:InvokeFunction
        Resource: arn:aws:lambda:us-east-2:123456789012:function:my-function