In this video, we are going to create execution role for a lambda functions with using a discrete commands.
When we creating any lambda function, it required to create execution role and it should include at
least lambda basic execution role per mission, which cover the Amazon Cloud Watch logs.
So we should create role first.
And after that we can use say like create function for that purpose.
Please open the widgets to the code and create new folder according to your lecture and put a command
text file is.
You can see that before starting any section I have created folder and the command takes the file and
locate command line directory for our new lecture.
You can see that I am in the lecture 46.
Okay, very good.
Now we are ready.
So now we are going to create an execution role for our lambda function.
Creating the execution role gives our function permission to access a resources in order to create an
execution role.
With the alias Sally we will use create role command.
So let me right in here.
We can see that you can find an example command that create a role.
We are using the a place I am create role command and specifying the role name which is the lambda execution
role x and we are specifying the symbol policy document.
Here you can see the policy document.
This is the in document that including the loading principles, which is the Lambda Service role and
the action is the HTML.
So this is the an example command that create an execution role.
And also I would like to see in the Windows version multi-line character.
You can see in here this is the same command with more readable.
So this is the command we specify thrust policy in line.
So this means in the role policy document we are inserting the trust policy in line documentation.
So here you can find the trust document and this is command is required for escaping codes in the JSON
setting and varying depending on the shell command window.
You can see that we are lots of characters that we need to escape these assume symbol and this will
be where I according to your command line window.
So that's why it is not a good way, right?
That should be one more way.
So we can also define this trusted policy for the role using a different separate JSON file.
So we will use trusted policy JSON, which is a file in the current directory.
In order to do that, we will allow these policies under the trust policy JSON file.
These transports allows Lambda to use roles permission by giving the service principal Lambda Amazon
a permission and the call a sacred token serves a symbol action.
So for that purpose, let me create a new file under these Lecture 46 directory.
So it is the trust slash trust dash policy JSON file.
Okay.
In this file, we basically create a single including required permissions.
This is the minimum permissions that we define for the lambda.
You can see that this is the effect allowing the principal lambda functions and action is a stc html.
So what is the thrust policy adjacent policy document in which you define the principles that we trust
to assume assumed role?
So this is the role trust policy is required resource based policy.
This is attached to role in the IAM.
So the principles that we can specify in the trust policy include the users roles, account and services.
So this is a mandatory step that we should create an execution role and the execution role requires
these kind of policies.
So to do activate this trust policy, I'm going back to the command text file and now I'm preparing
a command.
And this command has this time we are specifying the file name as a trusted policy.
So if we create for the Windows Multi-line character, so let me come here and put Windows and this
will be the our latest CLI commands.
So as you can see that this is the create using the I am a I am and create role command and we are specifying
the role name.
This is the role name lambda execution role and assume role is the trusted position that we are created
in the same directory.
Okay, now I'm going to.
Copy this command.
And in the same lecture folder.
Now copy these commands.
And now I'm going to paste command in here our command window and hit enter.
So this will be create an execution role.
And this is the response of our execution role.
You can see in here this is the role definition and role name is Lambda Dash X and role ID Aaron.
And this is the statement that we are specifying in the thrust policy JSON file.
Very good.
After that, we after we have created the execution role, we should attach the policies to role minimum
policy for a lambda is a lambda basic execution role policy is remember that when we create any lambda
function, it is creating an execution role with the basic execution role policy.
In order to add permissions to the role, we will use a policy to role command.
Let me start by adding the Lambda Basic Education Role Manager policy.
To do that, let me come here and.
Right that we should provide the.
Managed policy, which is name is based on the basic exemption role manager policy to specify that I'm
going to.
Run this command, which is the alias I am command and the name is the attack role policy.
So our real name is Lambda Dash X and the policy is and policy.
Aaron is our manager policy.
We can see that it is addressing the ID based on the basic execution role and this is the manage policy
by a W is that we can define our newly created execution role.
Which name is Lambda X?
So let me use this of course for Windows.
Let me copy this line of command and paste in here.
Hit the answer.
And this will be include a basic exemption role policy into our Lambda X execution role.
And these basic execution role policy has the permissions that the function needs to write the logs
to the Amazon Cloud watch logs.
So now it is successfully added and we can check the our Lambda X role in the management console and
see the policy JSON document.
So if you open the machine console and write down IAM, which is managing access resources and after
opening the identity and access management, we can collect the roles and search by the Lambda X.
Here is newly created lambda role that we can create from the SLA.
If you open the Lambda X execution role, you can see that the policy name is defined as we expected.
The policy is a Lambda Basic execution role.
This is managed policy by a yes.
You can see the type in here and if you click this button and see the details of this execution role,
this is basically allow the writing to log to the Amazon Cloud Watch logs.
So we successfully create execution role for our Lambda functions and we can also verify from the IAM
this is the lambda execution and you can also create roles in here.
It is very easy if you come to roles and click to create role, you can create the role as we specify
from the SQL Command into this management console.
Okay.
Also, I would like to show you one more thing, which is the lambda execution roles from the managed
by database.
If you come to this link of the this documentation of the ADA, which is if you scroll down, you can
see that ADA has several management managed policies.
We used ADA based on the basic execution role which including the cloud lock.
Right.
But also we can use the DB execution role kinesis MSC, ESC, SKU, VPC Daemon, right.
And so on, S3 Object Lambda.
These are the managed policies that we can use from the ADA Alias roles.
So you can see these all manage policies in these links that I will share in the video resources.
So as you can see that we have created the execution role.