Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon managed policies for Amazon Lambda

An Amazon managed policy is a standalone policy that is created and administered by Amazon. Amazon managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that Amazon managed policies might not grant least-privilege permissions for your specific use cases because they're available for all Amazon customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in Amazon managed policies. If Amazon updates the permissions defined in an Amazon managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. Amazon is most likely to update an Amazon managed policy when a new Amazon Web Service is launched or new API operations become available for existing services.

For more information, see Amazon managed policies in the IAM User Guide.

Amazon managed policy: AWSLambda_FullAccess

This policy grants full access to Lambda actions. It also grants permissions to other Amazon services that are used to develop and maintain Lambda resources.

You can attach the AWSLambda_FullAccess policy to your users, groups, and roles.

Permissions details

This policy includes the following permissions:

For more information about this policy, including the JSON policy document and policy versions, see AWSLambda_FullAccess in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambda_ReadOnlyAccess

This policy grants read-only access to Lambda resources and to other Amazon services that are used to develop and maintain Lambda resources.

You can attach the AWSLambda_ReadOnlyAccess policy to your users, groups, and roles.

Permissions details

This policy includes the following permissions:

For more information about this policy, including the JSON policy document and policy versions, see AWSLambda_ReadOnlyAccess in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaBasicExecutionRole

This policy grants permissions to upload logs to CloudWatch Logs.

You can attach the AWSLambdaBasicExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaBasicExecutionRole in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaDynamoDBExecutionRole

This policy grants permissions to read records from an Amazon DynamoDB stream and write to CloudWatch Logs.

You can attach the AWSLambdaDynamoDBExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaDynamoDBExecutionRole in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaENIManagementAccess

This policy grants permissions to create, describe, and delete elastic network interfaces used by a VPC-enabled Lambda function.

You can attach the AWSLambdaENIManagementAccess policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaENIManagementAccess in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaExecute

This policy grants PUT and GET access to Amazon Simple Storage Service and full access to CloudWatch Logs.

You can attach the AWSLambdaExecute policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaExecute in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaInvocation-DynamoDB

This policy grants read access to Amazon DynamoDB Streams.

You can attach the AWSLambdaInvocation-DynamoDB policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaInvocation-DynamoDB in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaKinesisExecutionRole

This policy grants permissions to read events from an Amazon Kinesis data stream and write to CloudWatch Logs.

You can attach the AWSLambdaKinesisExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaKinesisExecutionRole in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaMSKExecutionRole

This policy grants permissions to read and access records from an Amazon Managed Streaming for Apache Kafka cluster, manage elastic network interfaces, and write to CloudWatch Logs.

You can attach the AWSLambdaMSKExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaMSKExecutionRole in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaRole

This policy grants permissions to invoke Lambda functions.

You can attach the AWSLambdaRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaRole in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaSQSQueueExecutionRole

This policy grants permissions to read and delete messages from an Amazon Simple Queue Service queue, and grants write permissions to CloudWatch Logs.

You can attach the AWSLambdaSQSQueueExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaSQSQueueExecutionRole in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSLambdaVPCAccessExecutionRole

This policy grants permissions to manage elastic network interfaces within an Amazon Virtual Private Cloud and write to CloudWatch Logs.

You can attach the AWSLambdaVPCAccessExecutionRole policy to your users, groups, and roles.

For more information about this policy, including the JSON policy document and policy versions, see AWSLambdaVPCAccessExecutionRole in the Amazon Managed Policy Reference Guide.

Lambda updates to Amazon managed policies