AWS managed policies for AWS Lambda

An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.

For more information, see AWS managed policies in the IAM User Guide.

AWS managed policy: AWSLambda_FullAccess

This policy grants full access to Lambda actions. It also grants permissions to other AWS services that are used to develop and maintain Lambda resources.

You can attach the AWSLambda_FullAccess policy to your users, groups, and roles.

Permissions details

This policy includes the following permissions:

For more information about this policy, including the JSON policy document and policy versions, see AWSLambda_FullAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambda_ReadOnlyAccess

This policy grants read-only access to Lambda resources and to other AWS services that are used to develop and maintain Lambda resources.

You can attach the AWSLambda_ReadOnlyAccess policy to your users, groups, and roles.

Permissions details

This policy includes the following permissions:

For more information about this policy, including the JSON policy document and policy versions, see AWSLambda_ReadOnlyAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaBasicExecutionRole

This policy grants permissions to upload logs to CloudWatch Logs.

You can attach the AWSLambdaBasicExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaBasicExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaBasicDurableExecutionRolePolicy

This policy provides write permissions to CloudWatch Logs and read/write permissions to durable execution APIs used by Lambda durable functions. This policy provides the essential permissions required for Lambda durable functions, which use durable execution APIs to persist progress and maintain state across function invocations.

You can attach the AWSLambdaBasicDurableExecutionRolePolicy policy to your users, groups, and roles.

Permissions details

This policy includes the following permissions:

To view more details about the policy, including the latest version of the JSON policy document, see AWSLambdaBasicDurableExecutionRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaDynamoDBExecutionRole

This policy grants permissions to read records from an Amazon DynamoDB stream and write to CloudWatch Logs.

You can attach the AWSLambdaDynamoDBExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaDynamoDBExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaENIManagementAccess

This policy grants permissions to create, describe, and delete elastic network interfaces used by a VPC-enabled Lambda function.

You can attach the AWSLambdaENIManagementAccess policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaENIManagementAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaInvocation-DynamoDB

This policy grants read access to Amazon DynamoDB Streams.

You can attach the AWSLambdaInvocation-DynamoDB policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaInvocation-DynamoDB in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaKinesisExecutionRole

This policy grants permissions to read events from an Amazon Kinesis data stream and write to CloudWatch Logs.

You can attach the AWSLambdaKinesisExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaKinesisExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaMSKExecutionRole

This policy grants permissions to read and access records from an Amazon Managed Streaming for Apache Kafka cluster, manage elastic network interfaces, and write to CloudWatch Logs.

You can attach the AWSLambdaMSKExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaMSKExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaRole

This policy grants permissions to invoke Lambda functions.

You can attach the AWSLambdaRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaSQSQueueExecutionRole

This policy grants permissions to read and delete messages from an Amazon Simple Queue Service queue, and grants write permissions to CloudWatch Logs.

You can attach the AWSLambdaSQSQueueExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaSQSQueueExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaVPCAccessExecutionRole

This policy grants permissions to manage elastic network interfaces within an Amazon Virtual Private Cloud and write to CloudWatch Logs.

You can attach the AWSLambdaVPCAccessExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaVPCAccessExecutionRole in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaManagedEC2ResourceOperator

This policy enables automated Amazon Elastic Compute Cloud instance management for Lambda capacity providers. It grants permissions to the Lambda scaler service to perform instance lifecycle operations on your behalf.

You can attach the AWSLambdaManagedEC2ResourceOperator policy to your users, groups, and roles.

Permissions details

This policy includes the following permissions:

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaManagedEC2ResourceOperator in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSLambdaServiceRolePolicy

This policy is attached to the service-linked role named AWSServiceRoleForLambda to allow Lambda to terminate instances managed as part of Lambda capacity providers.

Permissions details

This policy includes the following permissions:

For more information about this policy, see Using service-linked roles for Lambda.

Lambda updates to AWS managed policies