0

There doesn't seem to be any way to define a policy about which S3 buckets Lambda is allowed to run code from.

With most services in AWS, the usual practice is to define an IAM role that can be assumed by the AWS service so that it can perform work on user-created resources in the account. For instance, Kinesis Firehose isn't allowed to write into one of your S3 buckets until it's explicitly granted permission with an IAM role.

Even with Lambda we have the concept of an execution role, that is the IAM role that can be used by custom code in our Lambda. But that still takes place after the code has been loaded.

Improve this question

1 Answer 1

Reset to default
0

This represents a misunderstanding of when Lambda code is loaded.

AWS Lambda does not download a copy of the code from S3 every time a function is executed. Instead, Lambda has its own internal storage that is updated when invoking CreateFunction or UpdateFunctionCode either through the API or the Console.

Update with further clarification from jdog:

Lambda is never given access to S3 buckets -- the user or role that runs CreateFunction is.

Improve this answer
2
  • Still, the question is valid -- even though Lambda only needs to access the deployment package from tbe bucket, once... how is it given permission to do so? There must be a mechanism, and it is not readily apparent from the CreateFunction or UpdateFunctionCode documentation, both of which just take bucket, object key, and optionally object version ID.
    – Michael - sqlbot
    Commented Mar 2, 2019 at 6:29
  • 1
    It is never given access. The user or role that runs CreateFunction is.
    – jdog
    Commented Mar 5, 2019 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.