AWS lambda: works locally but fails in deplyment

Question

I have a node.js lambda function that adds a database entry and then calls another lambda function. The code works fine when I test locally via

serverless invoke local --function create --path mocks/create-event.json

but it fails when I invoke the deployment

aws lambda invoke  --function-name create --payload file://mocks/create-event.json out.txt

here is the relevant lambda code:

try {
    await dynamoDbLib.call("put", params);  //OK locally and in deployment
    var lambda = new AWS.Lambda();
    const req = {
      FunctionName: 'eqtor-api-dev-mysim', 
      InvocationType: 'RequestResponse',
      LogType: 'Tail',
      Payload: JSON.stringify({ name: 'me' })
    };
    const result = await lambda.invoke(req).promise(); //OK locally but not in deployment
    console.log(result); 
    return success(params.Item);
  } catch (e) {
    return failure({ status: false });
  }

The command shows

{
    "ExecutedVersion": "$LATEST", 
    "StatusCode": 200
}

and in out.txt, I get

{"statusCode":500,"headers":{"Access-Control-Allow-Origin":"*","Access-Control-Allow-Credentials":true},"body":"{\"status\":false}"}

Any tips on how to debug this?

Answer 1

I've resolved the issue now.

First of all, console.log(e) should be used to log the result. Then the error will appear in CloudWatch.

The problem was that the role that was used by the lambda did not permit invoking other lambdas. This can be fixed by granting the missing InvokeFunction permission for the role.

Answer 2

Generally speaking a good practice for AWS Lambda is to map what are the services and permissions required for it to run properly then create a dedicated role for it with the required policies. I also recommend not using roles on multiple Lambdas, it tends to get very insecure fast if you do.