Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Lambda

AWS Lambda (service prefix: lambda) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS Lambda

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AddLayerVersionPermission	lambda	lambda:AddLayerVersionPermission			Permissions management, Write
AddPermission	lambda	lambda:AddPermission			Permissions management, Write
CheckpointDurableExecution	lambda	lambda:CheckpointDurableExecution			Write
CreateAlias	lambda	lambda:CreateAlias			Write
CreateCapacityProvider	lambda	lambda:CreateCapacityProvider			Write
		lambda:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	lambda.amazonaws.com	Write
CreateCodeSigningConfig	lambda	lambda:CreateCodeSigningConfig			Write
CreateCodeSigningConfig	lambda	lambda:TagResource			Tagging, Write
CreateEventSourceMapping	lambda	lambda:CreateEventSourceMapping			Write
CreateEventSourceMapping	lambda	lambda:TagResource			Tagging, Write
CreateFunction	lambda	lambda:CreateFunction			Write
		lambda:GetLayerVersion			Read
		lambda:PassCapacityProvider			Write
		lambda:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	lambda.amazonaws.com	Write
CreateFunctionUrlConfig	lambda	lambda:CreateFunctionUrlConfig			Write
DeleteAlias	lambda	lambda:DeleteAlias			Write
DeleteCapacityProvider	lambda	lambda:DeleteCapacityProvider			Write
DeleteCodeSigningConfig	lambda	lambda:DeleteCodeSigningConfig			Write
DeleteEventSourceMapping	lambda	lambda:DeleteEventSourceMapping			Write
DeleteFunction	lambda	lambda:DeleteFunction			Write
DeleteFunctionCodeSigningConfig	lambda	lambda:DeleteFunctionCodeSigningConfig			Write
DeleteFunctionConcurrency	lambda	lambda:DeleteFunctionConcurrency			Write
DeleteFunctionEventInvokeConfig	lambda	lambda:DeleteFunctionEventInvokeConfig			Write
DeleteFunctionUrlConfig	lambda	lambda:DeleteFunctionUrlConfig			Write
DeleteLayerVersion	lambda	lambda:DeleteLayerVersion			Write
DeleteProvisionedConcurrencyConfig	lambda	lambda:DeleteProvisionedConcurrencyConfig			Write
GetAccountSettings	lambda	lambda:GetAccountSettings			Read
GetAlias	lambda	lambda:GetAlias			Read
GetCapacityProvider	lambda	lambda:GetCapacityProvider			Read
GetCodeSigningConfig	lambda	lambda:GetCodeSigningConfig			Read
GetDurableExecution	lambda	lambda:GetDurableExecution			Read
GetDurableExecutionHistory	lambda	lambda:GetDurableExecutionHistory			Read
GetDurableExecutionState	lambda	lambda:GetDurableExecutionState			Read
GetEventSourceMapping	lambda	lambda:GetEventSourceMapping			Read
GetFunction	lambda	lambda:GetFunction			Read
GetFunction	lambda	lambda:ListTags			Read
GetFunctionCodeSigningConfig	lambda	lambda:GetFunctionCodeSigningConfig			Read
GetFunctionConcurrency	lambda	lambda:GetFunctionConcurrency			Read
GetFunctionConfiguration	lambda	lambda:GetFunctionConfiguration			Read
GetFunctionEventInvokeConfig	lambda	lambda:GetFunctionEventInvokeConfig			Read
GetFunctionRecursionConfig	lambda	lambda:GetFunctionRecursionConfig			Read
GetFunctionScalingConfig	lambda	lambda:GetFunctionScalingConfig			Read
GetFunctionUrlConfig	lambda	lambda:GetFunctionUrlConfig			Read
GetLayerVersion	lambda	lambda:GetLayerVersion			Read
GetLayerVersionByArn	lambda	lambda:GetLayerVersion			Read
GetLayerVersionPolicy	lambda	lambda:GetLayerVersionPolicy			Read
GetPolicy	lambda	lambda:GetPolicy			Read
GetProvisionedConcurrencyConfig	lambda	lambda:GetProvisionedConcurrencyConfig			Read
GetRuntimeManagementConfig	lambda	lambda:GetRuntimeManagementConfig			Read
Invoke	lambda	lambda:InvokeFunction			Write
InvokeAsync	lambda	lambda:InvokeAsync			Write
InvokeWithResponseStream	lambda	lambda:InvokeFunction			Write
ListAliases	lambda	lambda:ListAliases			List
ListCapacityProviders	lambda	lambda:ListCapacityProviders			List
ListCodeSigningConfigs	lambda	lambda:ListCodeSigningConfigs			List
ListDurableExecutionsByFunction	lambda	lambda:ListDurableExecutionsByFunction			List
ListEventSourceMappings	lambda	lambda:ListEventSourceMappings			List
ListFunctionEventInvokeConfigs	lambda	lambda:ListFunctionEventInvokeConfigs			List
ListFunctionUrlConfigs	lambda	lambda:ListFunctionUrlConfigs			List
ListFunctionVersionsByCapacityProvider	lambda	lambda:ListFunctionVersionsByCapacityProvider			List
ListFunctions	lambda	lambda:ListFunctions			List
ListFunctionsByCodeSigningConfig	lambda	lambda:ListFunctionsByCodeSigningConfig			List
ListLayerVersions	lambda	lambda:ListLayerVersions			List
ListLayers	lambda	lambda:ListLayers			List
ListProvisionedConcurrencyConfigs	lambda	lambda:ListProvisionedConcurrencyConfigs			List
ListTags	lambda	lambda:ListTags			Read
ListVersionsByFunction	lambda	lambda:ListVersionsByFunction			List
PublishLayerVersion	lambda	lambda:PublishLayerVersion			Write
PublishVersion	lambda	lambda:PublishVersion			Write
PutFunctionCodeSigningConfig	lambda	lambda:PutFunctionCodeSigningConfig			Write
PutFunctionConcurrency	lambda	lambda:PutFunctionConcurrency			Write
PutFunctionEventInvokeConfig	lambda	lambda:PutFunctionEventInvokeConfig			Write
PutFunctionRecursionConfig	lambda	lambda:PutFunctionRecursionConfig			Write
PutFunctionScalingConfig	lambda	lambda:PutFunctionScalingConfig			Write
PutProvisionedConcurrencyConfig	lambda	lambda:PutProvisionedConcurrencyConfig			Write
PutRuntimeManagementConfig	lambda	lambda:PutRuntimeManagementConfig			Write
RemoveLayerVersionPermission	lambda	lambda:RemoveLayerVersionPermission			Permissions management, Write
RemovePermission	lambda	lambda:RemovePermission			Permissions management, Write
SendDurableExecutionCallbackFailure	lambda	lambda:SendDurableExecutionCallbackFailure			Write
SendDurableExecutionCallbackHeartbeat	lambda	lambda:SendDurableExecutionCallbackHeartbeat			Write
SendDurableExecutionCallbackSuccess	lambda	lambda:SendDurableExecutionCallbackSuccess			Write
StopDurableExecution	lambda	lambda:StopDurableExecution			Write
TagResource	lambda	lambda:TagResource			Tagging, Write
UntagResource	lambda	lambda:UntagResource			Tagging, Write
UpdateAlias	lambda	lambda:UpdateAlias			Write
UpdateCapacityProvider	lambda	lambda:UpdateCapacityProvider			Write
UpdateCodeSigningConfig	lambda	lambda:UpdateCodeSigningConfig			Write
UpdateEventSourceMapping	lambda	lambda:UpdateEventSourceMapping			Write
UpdateFunctionCode	lambda	lambda:UpdateFunctionCode			Write
UpdateFunctionConfiguration	lambda	lambda:GetLayerVersion			Read
		lambda:PassCapacityProvider			Write
		lambda:UpdateFunctionConfiguration			Write
		iam:PassRole	iam:PassedToService	lambda.amazonaws.com	Write
UpdateFunctionEventInvokeConfig	lambda	lambda:UpdateFunctionEventInvokeConfig			Write
UpdateFunctionUrlConfig	lambda	lambda:UpdateFunctionUrlConfig			Write
CreateNetworkConnector	lambda-core	lambda:CreateNetworkConnector			Write
		lambda:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	lambda.amazonaws.com	Write
DeleteNetworkConnector	lambda-core	lambda:DeleteNetworkConnector			Write
GetNetworkConnector	lambda-core	lambda:GetNetworkConnector			Read
ListNetworkConnectors	lambda-core	lambda:ListNetworkConnectors			List
UpdateNetworkConnector	lambda-core	lambda:UpdateNetworkConnector			Write
UpdateNetworkConnector	lambda-core	iam:PassRole	iam:PassedToService	lambda.amazonaws.com	Write
CreateMicrovmAuthToken	lambda-microvms	lambda:CreateMicrovmAuthToken			Write
CreateMicrovmImage	lambda-microvms	lambda:CreateMicrovmImage			Write
		lambda:PassNetworkConnector			Write
		lambda:TagResource			Tagging, Write
		iam:PassRole			Write
CreateMicrovmShellAuthToken	lambda-microvms	lambda:CreateMicrovmShellAuthToken			Write
DeleteMicrovmImage	lambda-microvms	lambda:DeleteMicrovmImage			Write
DeleteMicrovmImageVersion	lambda-microvms	lambda:DeleteMicrovmImageVersion			Write
GetMicrovm	lambda-microvms	lambda:GetMicrovm			Read
GetMicrovmImage	lambda-microvms	lambda:GetMicrovmImage			Read
GetMicrovmImageBuild	lambda-microvms	lambda:GetMicrovmImageBuild			Read
GetMicrovmImageVersion	lambda-microvms	lambda:GetMicrovmImageVersion			Read
ListManagedMicrovmImageVersions	lambda-microvms	lambda:ListManagedMicrovmImageVersions			List
ListManagedMicrovmImages	lambda-microvms	lambda:ListManagedMicrovmImages			List
ListMicrovmImageBuilds	lambda-microvms	lambda:ListMicrovmImageBuilds			List
ListMicrovmImageVersions	lambda-microvms	lambda:ListMicrovmImageVersions			List
ListMicrovmImages	lambda-microvms	lambda:ListMicrovmImages			List
ListMicrovms	lambda-microvms	lambda:ListMicrovms			List
ListTags	lambda-microvms	lambda:ListTags			Read
ResumeMicrovm	lambda-microvms	lambda:ResumeMicrovm			Write
RunMicrovm	lambda-microvms	lambda:PassNetworkConnector			Write
		lambda:RunMicrovm			Write
		iam:PassRole			Write
SuspendMicrovm	lambda-microvms	lambda:SuspendMicrovm			Write
TagResource	lambda-microvms	lambda:TagResource			Tagging, Write
TerminateMicrovm	lambda-microvms	lambda:TerminateMicrovm			Write
UntagResource	lambda-microvms	lambda:UntagResource			Tagging, Write
UpdateMicrovmImage	lambda-microvms	lambda:PassNetworkConnector			Write
		lambda:UpdateMicrovmImage			Write
		iam:PassRole			Write
UpdateMicrovmImageVersion	lambda-microvms	lambda:UpdateMicrovmImageVersion			Write

Actions defined by AWS Lambda

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddLayerVersionPermission	Grants permission to add permissions to the resource-based policy of a version of an AWS Lambda layer	layerVersion*		Permissions management, Write
AddPermission	Grants permission to give an AWS service or another account permission to use an AWS Lambda function	function*	aws:ResourceTag/${TagKey} lambda:FunctionUrlAuthType lambda:Principal	Permissions management, Write
CheckpointDurableExecution	Grants permission to save the progress of an AWS Lambda durable execution	durable execution*		Write
CreateAlias	Grants permission to create an alias for a Lambda function version	function*	aws:ResourceTag/${TagKey}	Write
CreateCapacityProvider	Grants permission to create an AWS Lambda capacity provider	capacityProvider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys lambda:SecurityGroupIds lambda:SubnetIds	Write
CreateCodeSigningConfig	Grants permission to create an AWS Lambda code signing config		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateEventSourceMapping	Grants permission to create a mapping between an event source and an AWS Lambda function		aws:RequestTag/${TagKey} aws:TagKeys lambda:FunctionArn	Write
CreateFunction	Grants permission to create an AWS Lambda function	function*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys lambda:CodeSigningConfigArn lambda:Layer lambda:SecurityGroupIds lambda:SubnetIds lambda:VpcIds	Write
CreateFunctionUrlConfig	Grants permission to create a function url configuration for a Lambda function	function*	aws:ResourceTag/${TagKey} lambda:FunctionArn lambda:FunctionUrlAuthType	Write
CreateMicrovmAuthToken	Grants permission to create an auth token for an AWS Lambda MicroVM	microvmImage*	aws:ResourceTag/${TagKey}	Write
CreateMicrovmImage	Grants permission to create an AWS Lambda MicroVM image		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateMicrovmShellAuthToken	Grants permission to create a shell auth token for an AWS Lambda MicroVM	microvmImage*	aws:ResourceTag/${TagKey}	Write
CreateNetworkConnector	Grants permission to create an AWS Lambda network connector	networkConnector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys lambda:SecurityGroupIds lambda:SubnetIds	Write
DeleteAlias	Grants permission to delete an AWS Lambda function alias	function*	aws:ResourceTag/${TagKey}	Write
DeleteCapacityProvider	Grants permission to delete an AWS Lambda capacity provider	capacityProvider*	aws:ResourceTag/${TagKey}	Write
DeleteCodeSigningConfig	Grants permission to delete an AWS Lambda code signing config	code signing config*	aws:ResourceTag/${TagKey}	Write
DeleteEventSourceMapping	Grants permission to delete an AWS Lambda event source mapping	eventSourceMapping*	aws:ResourceTag/${TagKey} lambda:FunctionArn	Write
DeleteFunction	Grants permission to delete an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Write
DeleteFunctionCodeSigningConfig	Grants permission to detach a code signing config from an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Write
DeleteFunctionConcurrency	Grants permission to remove a concurrent execution limit from an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Write
DeleteFunctionEventInvokeConfig	Grants permission to delete the configuration for asynchronous invocation for an AWS Lambda function, version, or alias	function*	aws:ResourceTag/${TagKey}	Write
DeleteFunctionUrlConfig	Grants permission to delete function url configuration for a Lambda function	function*	aws:ResourceTag/${TagKey} lambda:FunctionArn lambda:FunctionUrlAuthType	Write
DeleteLayerVersion	Grants permission to delete a version of an AWS Lambda layer	layerVersion*		Write
DeleteMicrovmImage	Grants permission to delete an AWS Lambda MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	Write
DeleteMicrovmImageVersion	Grants permission to delete a version of an AWS Lambda MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	Write
DeleteNetworkConnector	Grants permission to delete an AWS Lambda network connector	networkConnector*	aws:ResourceTag/${TagKey}	Write
DeleteProvisionedConcurrencyConfig	Grants permission to delete the provisioned concurrency configuration for an AWS Lambda function	function alias	aws:ResourceTag/${TagKey}	Write
DeleteProvisionedConcurrencyConfig		function version	aws:ResourceTag/${TagKey}	Write
GetAccountSettings	Grants permission to view details about an account's limits and usage in an AWS Region			Read
GetAlias	Grants permission to view details about an AWS Lambda function alias	function*	aws:ResourceTag/${TagKey}	Read
GetCapacityProvider	Grants permission to view details about an AWS Lambda capacity provider	capacityProvider*	aws:ResourceTag/${TagKey}	Read
GetCodeSigningConfig	Grants permission to view details about an AWS Lambda code signing config	code signing config*	aws:ResourceTag/${TagKey}	Read
GetDurableExecution	Grants permission to view details of an AWS Lambda durable execution	durable execution*		Read
GetDurableExecutionHistory	Grants permission to view execution history of an AWS Lambda durable execution	durable execution*		Read
GetDurableExecutionState	Grants permission to view current state of an AWS Lambda durable execution	durable execution*		Read
GetEventSourceMapping	Grants permission to view details about an AWS Lambda event source mapping	eventSourceMapping*	aws:ResourceTag/${TagKey} lambda:FunctionArn	Read
GetFunction	Grants permission to view details about an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Read
GetFunctionCodeSigningConfig	Grants permission to view the code signing config arn attached to an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Read
GetFunctionConcurrency	Grants permission to view details about the reserved concurrency configuration for a function	function*	aws:ResourceTag/${TagKey}	Read
GetFunctionConfiguration	Grants permission to view details about the version-specific settings of an AWS Lambda function or version	function*	aws:ResourceTag/${TagKey}	Read
GetFunctionEventInvokeConfig	Grants permission to view the configuration for asynchronous invocation for a function, version, or alias	function*	aws:ResourceTag/${TagKey}	Read
GetFunctionRecursionConfig	Grants permission to view the recursion configuration of an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Read
GetFunctionScalingConfig	Grants permission to view the scaling configuration of an AWS Lambda function running on a capacity provider	function*	aws:ResourceTag/${TagKey}	Read
GetFunctionUrlConfig	Grants permission to read function url configuration for a Lambda function	function*	aws:ResourceTag/${TagKey} lambda:FunctionArn lambda:FunctionUrlAuthType	Read
GetLayerVersion	Grants permission to view details about a version of an AWS Lambda layer. Note this action also supports GetLayerVersionByArn API	layerVersion*		Read
GetLayerVersionPolicy	Grants permission to view the resource-based policy for a version of an AWS Lambda layer	layerVersion*		Read
GetMicrovm	Grants permission to view information about an AWS Lambda MicroVM	microvmImage*	aws:ResourceTag/${TagKey}	Read
GetMicrovmImage	Grants permission to view information about an AWS Lambda MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	Read
GetMicrovmImageBuild	Grants permission to view information about a build of an AWS Lambda MicroVM image version	microvmImage*	aws:ResourceTag/${TagKey}	Read
GetMicrovmImageVersion	Grants permission to view information about a version of an AWS Lambda MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	Read
GetNetworkConnector	Grants permission to view details about an AWS Lambda network connector	networkConnector*	aws:ResourceTag/${TagKey}	Read
GetPolicy	Grants permission to view the resource-based policy for an AWS Lambda function, version, or alias	function*	aws:ResourceTag/${TagKey}	Read
GetProvisionedConcurrencyConfig	Grants permission to view the provisioned concurrency configuration for an AWS Lambda function's alias or version	function alias	aws:ResourceTag/${TagKey}	Read
GetProvisionedConcurrencyConfig		function version	aws:ResourceTag/${TagKey}	Read
GetRuntimeManagementConfig	Grants permission to view the runtime management configuration of an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Read
InvokeAsync	Grants permission to invoke a function asynchronously (Deprecated)	function*	aws:ResourceTag/${TagKey}	Write
InvokeFunction	Grants permission to invoke an AWS Lambda function	function*	aws:ResourceTag/${TagKey} lambda:EventSourceToken lambda:InvokedViaFunctionUrl	Write
ListAliases	Grants permission to retrieve a list of aliases for an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	List
ListCapacityProviders	Grants permission to retrieve a list of AWS Lambda capacity providers			List
ListCodeSigningConfigs	Grants permission to retrieve a list of AWS Lambda code signing configs			List
ListDurableExecutionsByFunction	Grants permission to retrieve a list of AWS Lambda durable executions of an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	List
ListEventSourceMappings	Grants permission to retrieve a list of AWS Lambda event source mappings			List
ListFunctionEventInvokeConfigs	Grants permission to retrieve a list of configurations for asynchronous invocation for a function	function*	aws:ResourceTag/${TagKey}	List
ListFunctionUrlConfigs	Grants permission to read function url configurations for a function	function*	aws:ResourceTag/${TagKey} lambda:FunctionUrlAuthType	List
ListFunctionVersionsByCapacityProvider	Grants permission to retrieve a list of AWS Lambda function versions by the capacity provider assigned	capacityProvider*	aws:ResourceTag/${TagKey}	List
ListFunctions	Grants permission to retrieve a list of AWS Lambda functions, with the version-specific configuration of each function			List
ListFunctionsByCodeSigningConfig	Grants permission to retrieve a list of AWS Lambda functions by the code signing config assigned	code signing config*	aws:ResourceTag/${TagKey}	List
ListLayerVersions	Grants permission to retrieve a list of versions of an AWS Lambda layer			List
ListLayers	Grants permission to retrieve a list of AWS Lambda layers, with details about the latest version of each layer			List
ListManagedMicrovmImageVersions	Grants permission to retrieve a list of versions for a managed AWS Lambda MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	List
ListManagedMicrovmImages	Grants permission to retrieve a list of managed AWS Lambda MicroVM images			List
ListMicrovmImageBuilds	Grants permission to retrieve a list of builds for an AWS Lambda MicroVM image version	microvmImage*	aws:ResourceTag/${TagKey}	List
ListMicrovmImageVersions	Grants permission to retrieve a list of versions for an AWS Lambda MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	List
ListMicrovmImages	Grants permission to retrieve a list of AWS Lambda MicroVM images			List
ListMicrovms	Grants permission to retrieve a list of AWS Lambda MicroVMs			List
ListNetworkConnectors	Grants permission to retrieve a list of AWS Lambda network connectors			List
ListProvisionedConcurrencyConfigs	Grants permission to retrieve a list of provisioned concurrency configurations for an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	List
ListTags	Grants permission to retrieve a list of tags for an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector or MicroVM image resource	capacityProvider	aws:ResourceTag/${TagKey}	Read
		code signing config	aws:ResourceTag/${TagKey}
		eventSourceMapping	aws:ResourceTag/${TagKey}
		function	aws:ResourceTag/${TagKey}
		microvmImage	aws:ResourceTag/${TagKey}
		networkConnector	aws:ResourceTag/${TagKey}
ListVersionsByFunction	Grants permission to retrieve a list of versions for an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	List
PublishLayerVersion	Grants permission to create an AWS Lambda layer	layer*		Write
PublishVersion	Grants permission to create an AWS Lambda function version	function*	aws:ResourceTag/${TagKey}	Write
PutFunctionCodeSigningConfig	Grants permission to attach a code signing config to an AWS Lambda function	code signing config*	aws:ResourceTag/${TagKey} lambda:CodeSigningConfigArn	Write
PutFunctionCodeSigningConfig		function*	aws:ResourceTag/${TagKey} lambda:CodeSigningConfigArn	Write
PutFunctionConcurrency	Grants permission to configure reserved concurrency for an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Write
PutFunctionEventInvokeConfig	Grants permission to configures options for asynchronous invocation on an AWS Lambda function, version, or alias	function*	aws:ResourceTag/${TagKey}	Write
PutFunctionRecursionConfig	Grants permission to update the recursion configuration of an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Write
PutFunctionScalingConfig	Grants permission to update the scaling configuration of an AWS Lambda function running on a capacity provider	function*	aws:ResourceTag/${TagKey}	Write
PutProvisionedConcurrencyConfig	Grants permission to configure provisioned concurrency for an AWS Lambda function's alias or version	function alias	aws:ResourceTag/${TagKey}	Write
PutProvisionedConcurrencyConfig		function version	aws:ResourceTag/${TagKey}	Write
PutRuntimeManagementConfig	Grants permission to update the runtime management configuration of an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Write
RemoveLayerVersionPermission	Grants permission to remove a statement from the permissions policy for a version of an AWS Lambda layer	layerVersion*		Permissions management, Write
RemovePermission	Grants permission to revoke function-use permission from an AWS service or another account	function*	aws:ResourceTag/${TagKey} lambda:FunctionUrlAuthType lambda:Principal	Permissions management, Write
ResumeMicrovm	Grants permission to resume a suspended AWS Lambda MicroVM	microvmImage*	aws:ResourceTag/${TagKey}	Write
RunMicrovm	Grants permission to run an AWS Lambda MicroVM from a MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	Write
SendDurableExecutionCallbackFailure	Grants permission to send a failure response for a callback operation in an AWS Lambda durable execution	durable execution*		Write
SendDurableExecutionCallbackHeartbeat	Grants permission to send a heartbeat for a callback operation in an AWS Lambda durable execution	durable execution*		Write
SendDurableExecutionCallbackSuccess	Grants permission to send a successful response for a callback operation in an AWS Lambda durable execution	durable execution*		Write
StopDurableExecution	Grants permission to stop an AWS Lambda durable execution	durable execution*		Write
SuspendMicrovm	Grants permission to suspend an AWS Lambda MicroVM	microvmImage*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector or MicroVM image resource	capacityProvider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		code signing config	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		eventSourceMapping	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		function	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		microvmImage	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		networkConnector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TerminateMicrovm	Grants permission to terminate an AWS Lambda MicroVM	microvmImage*	aws:ResourceTag/${TagKey}	Write
UntagResource	Grants permission to remove tags from an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector or MicroVM image resource	capacityProvider	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		code signing config	aws:ResourceTag/${TagKey} aws:TagKeys
		eventSourceMapping	aws:ResourceTag/${TagKey} aws:TagKeys
		function	aws:ResourceTag/${TagKey} aws:TagKeys
		microvmImage	aws:ResourceTag/${TagKey} aws:TagKeys
		networkConnector	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAlias	Grants permission to update the configuration of an AWS Lambda function's alias	function*	aws:ResourceTag/${TagKey}	Write
UpdateCapacityProvider	Grants permission to update an AWS Lambda capacity provider	capacityProvider*	aws:ResourceTag/${TagKey}	Write
UpdateCodeSigningConfig	Grants permission to update an AWS Lambda code signing config	code signing config*	aws:ResourceTag/${TagKey}	Write
UpdateEventSourceMapping	Grants permission to update the configuration of an AWS Lambda event source mapping	eventSourceMapping*	aws:ResourceTag/${TagKey} lambda:FunctionArn	Write
UpdateFunctionCode	Grants permission to update the code of an AWS Lambda function	function*	aws:ResourceTag/${TagKey}	Write
UpdateFunctionCodeSigningConfig	Grants permission to update the code signing config of an AWS Lambda function	code signing config*	aws:ResourceTag/${TagKey}	Write
UpdateFunctionCodeSigningConfig		function*	aws:ResourceTag/${TagKey}	Write
UpdateFunctionConfiguration	Grants permission to modify the version-specific settings of an AWS Lambda function	function*	aws:ResourceTag/${TagKey} lambda:Layer lambda:SecurityGroupIds lambda:SubnetIds lambda:VpcIds	Write
UpdateFunctionEventInvokeConfig	Grants permission to modify the configuration for asynchronous invocation for an AWS Lambda function, version, or alias	function*	aws:ResourceTag/${TagKey}	Write
UpdateFunctionUrlConfig	Grants permission to update a function url configuration for a Lambda function	function*	aws:ResourceTag/${TagKey} lambda:FunctionArn lambda:FunctionUrlAuthType	Write
UpdateMicrovmImage	Grants permission to update an AWS Lambda MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	Write
UpdateMicrovmImageVersion	Grants permission to update a version of an AWS Lambda MicroVM image	microvmImage*	aws:ResourceTag/${TagKey}	Write
UpdateNetworkConnector	Grants permission to update an AWS Lambda network connector	networkConnector*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Lambda

The following actions are defined by AWS Lambda but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ConnectMicrovm	Grants permission to connect to a Lambda MicroVM via HTTP (VPC Endpoint only)			Write
DisableReplication	Grants permission to disable replication for a Lambda@Edge function	function*	aws:ResourceTag/${TagKey}	Permissions management, Write
EnableReplication	Grants permission to enable replication for a Lambda@Edge function	function*	aws:ResourceTag/${TagKey}	Permissions management, Write
InvokeFunctionUrl	Grants permission to invoke an AWS Lambda function through url	function*	aws:ResourceTag/${TagKey} lambda:EventSourceToken lambda:FunctionArn lambda:FunctionUrlAuthType	Write
PassCapacityProvider	Grants permission to pass an AWS Lambda capacity provider to a service	capacityProvider*	aws:ResourceTag/${TagKey}	Write
PassNetworkConnector	Grants permission to pass an AWS Lambda network connector to a service			Write

Resource types defined by AWS Lambda

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
capacityProvider	arn:${Partition}:lambda:${Region}:${Account}:capacity-provider:${CapacityProviderName}	aws:ResourceTag/${TagKey}
code signing config	arn:${Partition}:lambda:${Region}:${Account}:code-signing-config:${CodeSigningConfigId}	aws:ResourceTag/${TagKey}
durable execution	arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}:${Version}/durable-execution/${ExecutionName}/${ExecutionId}
eventSourceMapping	arn:${Partition}:lambda:${Region}:${Account}:event-source-mapping:${UUID}	aws:ResourceTag/${TagKey}
function	arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}	aws:ResourceTag/${TagKey}
function alias	arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}:${Alias}	aws:ResourceTag/${TagKey}
function version	arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}:${Version}	aws:ResourceTag/${TagKey}
layer	arn:${Partition}:lambda:${Region}:${Account}:layer:${LayerName}
layerVersion	arn:${Partition}:lambda:${Region}:${Account}:layer:${LayerName}:${LayerVersion}
microvmImage	arn:${Partition}:lambda:${Region}:${Account}:microvm-image:${MicrovmImageName}	aws:ResourceTag/${TagKey}
networkConnector	arn:${Partition}:lambda:${Region}:${Account}:network-connector:${NetworkConnectorId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Lambda

AWS Lambda defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
lambda:CodeSigningConfigArn	Filters access by the ARN of an AWS Lambda code signing config	ARN
lambda:EventSourceToken	Filters access by the ID from a non-AWS event source configured for the AWS Lambda function	String
lambda:FunctionArn	Filters access by the ARN of an AWS Lambda function	ARN
lambda:FunctionUrlAuthType	Filters access by authorization type specified in request. Available during CreateFunctionUrlConfig, UpdateFunctionUrlConfig, DeleteFunctionUrlConfig, GetFunctionUrlConfig, ListFunctionUrlConfig, AddPermission and RemovePermission operations	String
lambda:InvokedViaFunctionUrl	Limits the scope of lambda:InvokeFunction action to Function URLs only. Available during AddPermission operation	Bool
lambda:Layer	Filters access by the ARN of a version of an AWS Lambda layer	ArrayOfString
lambda:Principal	Filters access by restricting the AWS service or account that can invoke a function	String
lambda:SecurityGroupIds	Filters access by the ID of security groups configured for the AWS Lambda function	ArrayOfString
lambda:SourceFunctionArn	Filters access by the ARN of the AWS Lambda function from which the request originated	ARN
lambda:SubnetIds	Filters access by the ID of subnets configured for the AWS Lambda function	ArrayOfString
lambda:VpcIds	Filters access by the ID of the VPC configured for the AWS Lambda function	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Lake Formation (lakeformation)

AWS Launch Wizard (launchwizard)