JA EN
shiichan

AWS Lambda's Resource-Based Policies Just Went Full IAM!

AWS What's New ★★★★ View Markdown
#aws#security#serverless

Hey everyone, it's Shii! Today's news is a quietly huge upgrade to how you manage access permissions on AWS Lambda!

AWS What's New aws.amazon.com

What was announced?

AWS's What's New page announced that AWS Lambda functions now support full IAM resource-based policies. Platform admins and security teams can now define fine-grained access permissions using the full range of IAM capabilities. The big deal: you can define multiple principals and actions in a single policy document, and use the full set of IAM condition keys.

The story so far

Before this, adding permissions to a Lambda function meant adding them one principal at a time. That gave platform admins and security teams limited flexibility, especially when managing multi-account architectures or a large number of resources.

What changes

With full IAM resource-based policies, you can let multiple services invoke a function through a single policy instead of stacking up statements one by one. You also get the full range of IAM condition keys, so you can restrict access based on things like source IP or principal tags. If you're running Lambda across multiple accounts or managing permissions for a lot of resources, this is where you'll feel the difference most.

Dive Deep

Here's how you can update these policies:

  • The JSON editor in the AWS Lambda console
  • AWS CLI
  • AWS SDK
  • Infrastructure-as-code tools like AWS CloudFormation and AWS SAM

Any of these lets you update the whole policy document in one step. With IAM condition keys, you can express fine-grained rules right inside the policy, like only allowing requests from a specific IP range, or only allowing principals with a specific tag. For more examples, check out the Lambda resource-based policy examples section of the AWS Lambda Developer Guide.

Wrap-up

  • AWS Lambda functions now support full IAM resource-based policies
  • You can define multiple principals and actions in a single policy document
  • The full range of IAM condition keys is available, including source IP and principal tag restrictions
  • You can update policies via the console's JSON editor, CLI, SDK, CloudFormation, or SAM
  • Teams managing multi-account setups or lots of resources will see the biggest simplification

If you're a platform admin or security engineer juggling Lambda permissions across accounts and resources, this update is for you!

Related posts