1 00:00:00,270 --> 00:00:08,100 In this video, we are going to create execution role for a lambda functions with using a discrete commands. 2 00:00:08,700 --> 00:00:15,060 When we creating any lambda function, it required to create execution role and it should include at 3 00:00:15,060 --> 00:00:20,130 least lambda basic execution role per mission, which cover the Amazon Cloud Watch logs. 4 00:00:20,460 --> 00:00:22,500 So we should create role first. 5 00:00:22,500 --> 00:00:27,180 And after that we can use say like create function for that purpose. 6 00:00:27,180 --> 00:00:34,620 Please open the widgets to the code and create new folder according to your lecture and put a command 7 00:00:34,650 --> 00:00:36,120 text file is. 8 00:00:36,120 --> 00:00:42,660 You can see that before starting any section I have created folder and the command takes the file and 9 00:00:42,660 --> 00:00:45,990 locate command line directory for our new lecture. 10 00:00:45,990 --> 00:00:48,660 You can see that I am in the lecture 46. 11 00:00:49,140 --> 00:00:49,830 Okay, very good. 12 00:00:49,830 --> 00:00:50,730 Now we are ready. 13 00:00:50,880 --> 00:00:54,600 So now we are going to create an execution role for our lambda function. 14 00:00:54,630 --> 00:01:01,290 Creating the execution role gives our function permission to access a resources in order to create an 15 00:01:01,290 --> 00:01:02,040 execution role. 16 00:01:02,040 --> 00:01:06,180 With the alias Sally we will use create role command. 17 00:01:06,330 --> 00:01:08,970 So let me right in here. 18 00:01:08,970 --> 00:01:15,060 We can see that you can find an example command that create a role. 19 00:01:15,090 --> 00:01:23,130 We are using the a place I am create role command and specifying the role name which is the lambda execution 20 00:01:23,130 --> 00:01:27,630 role x and we are specifying the symbol policy document. 21 00:01:27,960 --> 00:01:31,530 Here you can see the policy document. 22 00:01:31,710 --> 00:01:38,850 This is the in document that including the loading principles, which is the Lambda Service role and 23 00:01:38,850 --> 00:01:40,380 the action is the HTML. 24 00:01:40,710 --> 00:01:45,780 So this is the an example command that create an execution role. 25 00:01:45,990 --> 00:01:51,720 And also I would like to see in the Windows version multi-line character. 26 00:01:51,750 --> 00:01:55,230 You can see in here this is the same command with more readable. 27 00:01:55,500 --> 00:02:00,720 So this is the command we specify thrust policy in line. 28 00:02:00,720 --> 00:02:08,130 So this means in the role policy document we are inserting the trust policy in line documentation. 29 00:02:08,130 --> 00:02:16,290 So here you can find the trust document and this is command is required for escaping codes in the JSON 30 00:02:16,290 --> 00:02:19,650 setting and varying depending on the shell command window. 31 00:02:19,680 --> 00:02:28,380 You can see that we are lots of characters that we need to escape these assume symbol and this will 32 00:02:28,380 --> 00:02:32,070 be where I according to your command line window. 33 00:02:32,070 --> 00:02:34,380 So that's why it is not a good way, right? 34 00:02:34,380 --> 00:02:36,060 That should be one more way. 35 00:02:36,060 --> 00:02:43,530 So we can also define this trusted policy for the role using a different separate JSON file. 36 00:02:43,770 --> 00:02:49,830 So we will use trusted policy JSON, which is a file in the current directory. 37 00:02:49,950 --> 00:02:56,490 In order to do that, we will allow these policies under the trust policy JSON file. 38 00:02:56,520 --> 00:03:03,180 These transports allows Lambda to use roles permission by giving the service principal Lambda Amazon 39 00:03:03,190 --> 00:03:08,550 a permission and the call a sacred token serves a symbol action. 40 00:03:08,550 --> 00:03:15,510 So for that purpose, let me create a new file under these Lecture 46 directory. 41 00:03:15,630 --> 00:03:21,720 So it is the trust slash trust dash policy JSON file. 42 00:03:21,750 --> 00:03:22,340 Okay. 43 00:03:22,470 --> 00:03:29,040 In this file, we basically create a single including required permissions. 44 00:03:29,040 --> 00:03:32,910 This is the minimum permissions that we define for the lambda. 45 00:03:33,090 --> 00:03:42,270 You can see that this is the effect allowing the principal lambda functions and action is a stc html. 46 00:03:42,270 --> 00:03:48,960 So what is the thrust policy adjacent policy document in which you define the principles that we trust 47 00:03:48,960 --> 00:03:50,850 to assume assumed role? 48 00:03:51,570 --> 00:03:55,410 So this is the role trust policy is required resource based policy. 49 00:03:55,440 --> 00:03:58,140 This is attached to role in the IAM. 50 00:03:58,140 --> 00:04:04,830 So the principles that we can specify in the trust policy include the users roles, account and services. 51 00:04:04,830 --> 00:04:10,530 So this is a mandatory step that we should create an execution role and the execution role requires 52 00:04:10,560 --> 00:04:12,030 these kind of policies. 53 00:04:12,120 --> 00:04:21,570 So to do activate this trust policy, I'm going back to the command text file and now I'm preparing 54 00:04:21,570 --> 00:04:22,590 a command. 55 00:04:23,160 --> 00:04:29,820 And this command has this time we are specifying the file name as a trusted policy. 56 00:04:30,060 --> 00:04:38,100 So if we create for the Windows Multi-line character, so let me come here and put Windows and this 57 00:04:38,100 --> 00:04:41,040 will be the our latest CLI commands. 58 00:04:41,280 --> 00:04:48,210 So as you can see that this is the create using the I am a I am and create role command and we are specifying 59 00:04:48,210 --> 00:04:48,960 the role name. 60 00:04:49,290 --> 00:04:56,130 This is the role name lambda execution role and assume role is the trusted position that we are created 61 00:04:56,130 --> 00:04:57,660 in the same directory. 62 00:04:57,900 --> 00:04:59,940 Okay, now I'm going to. 63 00:05:00,070 --> 00:05:01,210 Copy this command. 64 00:05:01,870 --> 00:05:04,440 And in the same lecture folder. 65 00:05:04,700 --> 00:05:06,550 Now copy these commands. 66 00:05:06,550 --> 00:05:13,030 And now I'm going to paste command in here our command window and hit enter. 67 00:05:13,270 --> 00:05:15,640 So this will be create an execution role. 68 00:05:15,640 --> 00:05:18,310 And this is the response of our execution role. 69 00:05:18,340 --> 00:05:26,590 You can see in here this is the role definition and role name is Lambda Dash X and role ID Aaron. 70 00:05:26,770 --> 00:05:32,380 And this is the statement that we are specifying in the thrust policy JSON file. 71 00:05:32,410 --> 00:05:33,220 Very good. 72 00:05:33,400 --> 00:05:41,050 After that, we after we have created the execution role, we should attach the policies to role minimum 73 00:05:41,050 --> 00:05:48,580 policy for a lambda is a lambda basic execution role policy is remember that when we create any lambda 74 00:05:48,580 --> 00:05:53,530 function, it is creating an execution role with the basic execution role policy. 75 00:05:53,740 --> 00:05:59,380 In order to add permissions to the role, we will use a policy to role command. 76 00:05:59,410 --> 00:06:04,210 Let me start by adding the Lambda Basic Education Role Manager policy. 77 00:06:04,390 --> 00:06:07,540 To do that, let me come here and. 78 00:06:09,250 --> 00:06:12,040 Right that we should provide the. 79 00:06:12,780 --> 00:06:20,220 Managed policy, which is name is based on the basic exemption role manager policy to specify that I'm 80 00:06:20,220 --> 00:06:21,150 going to. 81 00:06:22,290 --> 00:06:30,630 Run this command, which is the alias I am command and the name is the attack role policy. 82 00:06:30,750 --> 00:06:35,760 So our real name is Lambda Dash X and the policy is and policy. 83 00:06:35,790 --> 00:06:39,060 Aaron is our manager policy. 84 00:06:39,090 --> 00:06:45,210 We can see that it is addressing the ID based on the basic execution role and this is the manage policy 85 00:06:45,210 --> 00:06:50,010 by a W is that we can define our newly created execution role. 86 00:06:50,010 --> 00:06:51,510 Which name is Lambda X? 87 00:06:51,510 --> 00:06:55,650 So let me use this of course for Windows. 88 00:06:57,100 --> 00:07:01,270 Let me copy this line of command and paste in here. 89 00:07:01,300 --> 00:07:02,530 Hit the answer. 90 00:07:03,950 --> 00:07:10,760 And this will be include a basic exemption role policy into our Lambda X execution role. 91 00:07:10,910 --> 00:07:16,790 And these basic execution role policy has the permissions that the function needs to write the logs 92 00:07:16,790 --> 00:07:18,680 to the Amazon Cloud watch logs. 93 00:07:18,830 --> 00:07:28,280 So now it is successfully added and we can check the our Lambda X role in the management console and 94 00:07:28,280 --> 00:07:30,260 see the policy JSON document. 95 00:07:30,290 --> 00:07:41,150 So if you open the machine console and write down IAM, which is managing access resources and after 96 00:07:41,150 --> 00:07:49,490 opening the identity and access management, we can collect the roles and search by the Lambda X. 97 00:07:49,940 --> 00:07:56,190 Here is newly created lambda role that we can create from the SLA. 98 00:07:56,270 --> 00:08:03,590 If you open the Lambda X execution role, you can see that the policy name is defined as we expected. 99 00:08:03,590 --> 00:08:06,500 The policy is a Lambda Basic execution role. 100 00:08:06,530 --> 00:08:09,050 This is managed policy by a yes. 101 00:08:09,080 --> 00:08:16,100 You can see the type in here and if you click this button and see the details of this execution role, 102 00:08:16,130 --> 00:08:20,630 this is basically allow the writing to log to the Amazon Cloud Watch logs. 103 00:08:20,750 --> 00:08:29,450 So we successfully create execution role for our Lambda functions and we can also verify from the IAM 104 00:08:29,480 --> 00:08:33,640 this is the lambda execution and you can also create roles in here. 105 00:08:33,650 --> 00:08:41,690 It is very easy if you come to roles and click to create role, you can create the role as we specify 106 00:08:41,690 --> 00:08:47,150 from the SQL Command into this management console. 107 00:08:47,390 --> 00:08:48,140 Okay. 108 00:08:48,350 --> 00:08:54,560 Also, I would like to show you one more thing, which is the lambda execution roles from the managed 109 00:08:54,560 --> 00:08:55,600 by database. 110 00:08:55,610 --> 00:09:01,010 If you come to this link of the this documentation of the ADA, which is if you scroll down, you can 111 00:09:01,010 --> 00:09:05,720 see that ADA has several management managed policies. 112 00:09:05,720 --> 00:09:10,730 We used ADA based on the basic execution role which including the cloud lock. 113 00:09:10,760 --> 00:09:11,060 Right. 114 00:09:11,060 --> 00:09:19,730 But also we can use the DB execution role kinesis MSC, ESC, SKU, VPC Daemon, right. 115 00:09:19,730 --> 00:09:21,800 And so on, S3 Object Lambda. 116 00:09:21,800 --> 00:09:27,530 These are the managed policies that we can use from the ADA Alias roles. 117 00:09:27,530 --> 00:09:34,010 So you can see these all manage policies in these links that I will share in the video resources. 118 00:09:34,190 --> 00:09:37,940 So as you can see that we have created the execution role.