‫So now let's talk
‫about Lambda execution roles and permissions.
‫So we've done a lot of this already through the hands-on
‫so I'm sure that you understand exactly how this works
‫but it's good to go back
‫to a theory lecture just to try it out.
‫So an IAM Role must be attached to your lambda function
‫and this will grant the Lambda function
‫the permission to access AWS services and resources.
‫And there are some simple managed policies for Lambda
‫that we can reuse, for example, the BasicExecutionRole
‫which allowed us to upload logs to CloudWatch,
‫but there is the KinesisExecutionRole to read from Kinesis,
‫the DynamoDBExecutionRole to read from DynamoDB streams,
‫the SQSQueueExecutionRole to read from SQS,
‫the LambdaVPCAccessExecutionRole,
‫which is allowing us to deploy Lambda functions
‫inside our VPC, as we'll see in this section,
‫and the XrayDaemonWriteAccess to upload trace data to X-Ray
‫as we'll see in this section as well.
‫So this are managed policies
‫but we can create obviously our own policy for Lambda.
‫So whenever we use an event source mapping
‫to invoke our function,
‫Lambda is the one thing that we'll be reading the data,
‫and so therefore we must use an execution role
‫to read the event data.
‫In the other way, the Lambda function was invoked
‫by other services so we didn't need a specific IAM Role
‫with some specific permissions.
‫By the way the best practice
‫is to create one Lambda execution role per function,
‫as we've been doing so far in the hands-on.
‫So, this is for the event source mapping,
‫or if our Lambda function actually needs
‫to invoke other services,
‫but what about if our Lambda function
‫is invoked by other services,
‫then we use resource-based policy,
‫and this is to give other accounts
‫or other AWS services permissions
‫to use your Lambda resources,
‫so, to invoke it on the function,
‫and this is very similar to an S3 bucket policy
‫for Amazon S3 buckets.
‫So the rule is that's an IAM principle
‫can access your Lambda function
‫if one of these two things happen.
‫First, the IAM policy attached
‫to the principal authorizes it.
‫So for example, we have our IAM user
‫and we have full permissions,
‫so we can access our Lambda function,
‫this is what we've been doing so far,
‫thanks to our administrator access policy.
‫Or if we have a resource-based policy
‫to authorize access to Lambda function,
‫this is more helpful
‫when you have a service to service access.
‫So we've seen it before, but we'll see it again.
‫When another AWS service like Amazon S3
‫wants to invoke our Lambda function,
‫then we need to make sure the resource-based policy
‫gives it access.
‫And this is something that's the console
‫has unforced behind the scenes,
‫but if you were to do your own integrations,
‫this is where you would do it yourself.
‫So let's go and do the console to see how that works.