In this video, we are going to learn Ada Lovelace, Lambda Permissions, which is the execution role
and the resource based policy.
Ada Lovelace has a service that handle permissions.
Which name is ADA Identity and Access Management?
We can call I am so we can use ADA Lovelace Identity and Access Management.
I am in order to manage access to Lambda functions.
We can manage permissions in a permission policy that we can apply to users, groups and roles in order
to execute lambda functions with policy definitions.
So basically, Lambda function also has a policy which name is execution role.
Lambda execution grants permissions to access the ADA services and resources by default.
LAMB The function needs to access to Amazon Cloud watch logs for log streaming.
So that means when we create any lambda function by default, it comes with the execution role which
including Amazon cloud, which logs.
So if Lambda Function will access services with the ADA SDK, we should grant it permissions to call
Ada Lovelace resources in the execution mode.
For example, if our Lambda function access to dynamic DB to perform CRUD operations, we should give
required permissions in the execution role of the lambda function as the same way.
Lambda also uses the execution role to get permissions to read from event sources.
When you use an event source mapping to trigger our function, for example, if our lambda function
read Q records from the Amazon case, we should give required permissions in the execution role of the
lambda function.
There is also another type of permission of lambda function, which is the resource based policy.
We will use the source based policy to give other aid sources permission to use our lambda function.
For example, when an individual service like Amazon S3 calls invoke our lambda function.
The resource based policy gives it access.
So now let me see one by one these two role and permissions.
I would like to start with the lambda execution world.
If you summarize the permissions on a lambda, we will use two type of permissions when working with
a lambda.
The first one is the lambda execution role, and the second one is the resource based policy.
Now, let's elaborate these permissions one by one.
A the based lambda execution role.
Lambda execution role is an IAM role that lambda has permissions to assume when invoking lambda function.
We need to select or create an execution role when creating a new lambda function.
And after that we can also modify the policies associated with the IAM role using the IAM.
We set that the default lambda execution role includes the permission to write to Amazon Cloud Watch
logs.
So when we modify this execution role, if you have additional targets from your lambda function, for
example, performing CRUD operations on the DB table or sending notification to Amazon SANS or try to
access any other resources from Lambda function, then lambda functions execution will required permissions
to interact with those services.
For example, write database or send SNS topic.
These kind of roles need to assign the lambda execution role.
That means we should grant these services into lambda execution role.
If Lambda function needs to retrieve messages from the queue or streams with the event source way,
we should also grant execution rule to pull message from the queue because in streaming event source
mapping scenario, lambda actively pulls the queue to get batch of records and that means it needs to
permission into execution.
All the best practice, the use execution roll or any granting permission is grant least privileged
access to your lambda execution role.
When you first create an IAM role for your lambda function during the development phase, you might
sometimes grant permissions beyond what is required before publishing your function in the production
environment.
Best practice is to adjust the policy to include only required permissions.
A double major policy for Lambda features.
ADA has also managed policies for Lambda execution rules.
You can see on the image slide, which is including the Lambda execution rules.
There is some execution rule in here.
You can see that ADA is Lambda Basic execution rule in here.
It is basically Lambda started tracking change to this policy.
Lambda execution world grants permission to upload logs to cloud watch and we can also this kind of
manage policies like for dynamic DB.
Here you can find a lambda dynamic DB execution role.
This is grants permission to read records from Amazon, dynamic TV streams and right to cloud watch.
And also you can see this Amazon idealism, the exquisite execution role.
This is basically grants permission to read a message from Amazon as case queue and right to cloud watch
logs.
And there is also lots of managed policies in a place environment that you can assign this execution
role when you create your lambda function.
You can check this address and see what else can be happening here.
If you come this address and if you scroll down, you can see that these are the manage policies provided
from the ADA is that we can assign when we create our lambda functions to see that this is Dynamo DB,
Kinesis, s case S3 and so on.
You can set these managed policies according to your use cases.
Okay.
If you come back to our slide, we can continue the another permission type, which is the Lambda resource
based policy.
So basically we have another permission type for Lambda function, which is the resource based policy.
We used resource based policy one in a service invoke our lambda function, synchronous or asynchronous
way resource based policy.
Let us to grant usage permission to other accounts or organization on per users basis.
You also use a resource based policy to allow any service to invoke or function on your behalf.
For example, if you create an API gateway that targets to Lambda function, we should add the resource
based policy permission to invoke Lambda function from API Gateway.
This is a synchronous invocation example that API Gateway invokes to lambda function synchronously.
We should add resource based policy if we give an example for asynchronous case, Amazon S3 uploads
even trigger to lambda function asynchronously.
So we should also add resource based policy into our lambda function grants.
S3 invocations.
And I would like to show you an example, resource based policy documentation.
If you come here in this address, you can see that the example, the resource based policy.
In this example, you can see that we are giving the lambda invoke function action from the Amazon S3
so Amazon S3 can be trigger lambda function asynchronously when uploading an object into the bucket.
And it is requiring this kind of resource based policy in order to invoke our lambda function correctly.
Otherwise, this will be get an error, which is an unauthorized error.
But we can set the resource based policy from the management console.
We can choose the function, choose the configurations and choose the permissions permissions.
Under the permission types.
We can set the resource based policy, and you can see the example statement that allows the Amazon
S3 to invoke our Lambda function.
Which name is the my function and our bucket name is in here also.
So as you can see that we have understood to a Lambda Permissions, the first one is the execution role
and the second one is the resource based policy.
You can see the image in here.
Here is the lambda function.
If we want to interact with some resources, we need to include the permissions under the lambda execution
role to interact performing the code operation with Dynamo DB or put put logs in the cloud watch logs
or put any Q system case and so on.
This is the execution role, but when it comes to some services to the lambda function, synchronous
or asynchronous way, we should set the resource based policy.
For example, if we expose an API to invoke the Lambda function from the API gateway, we should add
the resource based policy to invoke synchronous lambda function.
Or we can set the Amazon S3 or SAS asynchronous stream of our lambda function.
It is also required resource based policy.
This is a very good illustration to understand the permissions for the lambda function, for the execution
role and the resource based policy.
Now we can continue to our testing lambda function.
We're using the management console.