Product logo
DocsBlogPricing

Permissions for @turbot/aws-lambda

Taking a look at permissions and associated grant levels for each permission for Lambda:

PermissionGrant LevelHelp
iam:ListRolesMetadata
iam:PassRoleAdminTo create a Lambda function the user must have permission to pass the role to it.
lambda:AddLayerVersionPermissionAdminAddLayerVersionPermission is for resources utilizing the push model. This will be common and should be at Operator level. But it allows cross-account pushing to Lambda so needs associated guardrails.
lambda:AddPermissionAdminAddPermission is for resources utilizing the push model. This will be common and should be at Operator level. But it allows cross-account pushing to Lambda so needs associated guardrails.
lambda:CreateAliasAdminAdmin controls functions release of functions and aliases to functions.
lambda:CreateCodeSigningConfigAdmin
lambda:CreateEventSourceMappingOperatorOperators can manage the triggers & use of functions.
lambda:CreateFunctionAdminAdmin controls functions release of functions and aliases to functions.
lambda:DeleteAliasAdminAdmin controls functions release of functions and aliases to functions.
lambda:DeleteCodeSigningConfigAdmin
lambda:DeleteEventSourceMappingOperatorOperators can manage the triggers & use of functions.
lambda:DeleteFunctionAdminAdmin controls functions release of functions and aliases to functions.
lambda:DeleteFunctionAdminAdmin controls functions release of functions and aliases to functions.
lambda:DeleteFunctionCodeSigningConfigAdmin
lambda:DeleteFunctionConcurrencyAdminAdmin can manage concurrent execution limit.
lambda:DeleteFunctionEventInvokeConfigAdmin
lambda:DeleteLayerVersionAdmin
lambda:DeleteProvisionedConcurrencyConfigAdmin
lambda:DisableReplicationAdmin
lambda:EnableReplicationAdminAdmins can Add a permission to resource policy that gives Lambda replication service permission to get function code and configuration.
lambda:GetAccountSettingsMetadata
lambda:GetAliasMetadata
lambda:GetCodeSigningConfigMetadata
lambda:GetFunctionCodeSigningConfigMetadata
lambda:GetEventSourceMappingMetadata
lambda:GetFunctionCodeSigningConfigMetadata
lambda:GetFunctionReadOnlyLambda function code is considered data and requires privileges to view.
lambda:GetFunctionConcurrencyMetadata
lambda:GetFunctionConfigurationMetadata
lambda:GetFunctionEventInvokeConfigMetadata
lambda:GetLayerVersionReadOnly
lambda:GetLayerVersionByArnMetadata
lambda:GetLayerVersionPolicyMetadata
lambda:GetPolicyMetadata
lambda:GetProvisionedConcurrencyConfigMetadata
lambda:InvokeAsyncOperatorNOTE - Deprecated use Invoke instead.
lambda:InvokeFunctionOperatorOperators can invoke/run functions.
lambda:ListAliasesMetadata
lambda:ListCodeSigningConfigsMetadata
lambda:ListEventSourceMappingsMetadata
lambda:ListFunctionsByCodeSigningConfigMetadata
lambda:ListFunctionEventInvokeConfigsMetadata
lambda:ListFunctionsMetadataDoes not include function code only the configuration information.
lambda:ListLayerVersionsMetadata
lambda:ListLayersMetadata
lambda:ListProvisionedConcurrencyConfigsMetadata
lambda:ListTagsMetadata
lambda:ListVersionsByFunctionMetadata
lambda:PublishLayerVersionAdminAdmins can create a function layer from a ZIP archive. Each time you call PublishLayerVersion with the same version name a new version is created.
lambda:PublishVersionAdminAdmin controls functions release of functions and aliases to functions.
lambda:PutFunctionConcurrencyAdminAdmin can manage concurrent execution limit.
lambda:PutFunctionEventInvokeConfigAdmin
lambda:PutFunctionCodeSigningConfigAdmin
lambda:PutProvisionedConcurrencyConfigAdmin
lambda:RemoveLayerVersionPermissionAdmin
lambda:RemovePermissionOperatorAllows removal of permissions from push resources. This can be safely granted to Operator since it doesn't allow extra permissions.
lambda:TagResourceOperatorOperators can manage tags.
lambda:UntagResourceOperatorOperators can manage tags.
lambda:UpdateAliasOperator"Operators can deploy released versions. (But can't control releases or edit functions.)"
lambda:UpdateCodeSigningConfigAdmin
lambda:UpdateEventSourceMappingOperatorOperators can manage the triggers & use of functions.
lambda:UpdateFunctionCodeAdminAdmin controls functions release of functions and aliases to functions.
lambda:UpdateFunctionCodeSigningConfigAdmin
lambda:UpdateFunctionConfigurationAdminAdmin controls functions release of functions and aliases to functions.
lambda:UpdateFunctionEventInvokeConfigAdmin
s3:GetObjectOperator