Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Lambda

AWS Lambda (service prefix: lambda) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS Lambda

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AddEventSource	lambda	iam:PassRole	iam:PassedToService	lambda.amazonaws.com	Write
AddLayerVersionPermission	lambda	lambda:AddLayerVersionPermission			Permissions management, Write
AddPermission	lambda	lambda:AddPermission			Permissions management, Write
CheckpointDurableExecution	lambda	lambda:CheckpointDurableExecution			Write
CreateAlias	lambda	lambda:CreateAlias			Write
CreateCapacityProvider	lambda	lambda:CreateCapacityProvider			Write
		lambda:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	lambda.amazonaws.com	Write
CreateCodeSigningConfig	lambda	lambda:CreateCodeSigningConfig			Write
CreateCodeSigningConfig	lambda	lambda:TagResource			Tagging, Write
CreateEventSourceMapping	lambda	lambda:CreateEventSourceMapping			Write
CreateEventSourceMapping	lambda	lambda:TagResource			Tagging, Write
CreateFunction	lambda	lambda:CreateFunction			Write
		lambda:GetLayerVersion			Read
		lambda:PassCapacityProvider			Write
		lambda:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	lambda.amazonaws.com	Write
CreateFunctionUrlConfig	lambda	lambda:CreateFunctionUrlConfig			Write
DeleteAlias	lambda	lambda:DeleteAlias			Write
DeleteCapacityProvider	lambda	lambda:DeleteCapacityProvider			Write
DeleteCodeSigningConfig	lambda	lambda:DeleteCodeSigningConfig			Write
DeleteEventSourceMapping	lambda	lambda:DeleteEventSourceMapping			Write
DeleteFunction	lambda	lambda:DeleteFunction			Write
DeleteFunctionCodeSigningConfig	lambda	lambda:DeleteFunctionCodeSigningConfig			Write
DeleteFunctionConcurrency	lambda	lambda:DeleteFunctionConcurrency			Write
DeleteFunctionEventInvokeConfig	lambda	lambda:DeleteFunctionEventInvokeConfig			Write
DeleteFunctionUrlConfig	lambda	lambda:DeleteFunctionUrlConfig			Write
DeleteLayerVersion	lambda	lambda:DeleteLayerVersion			Write
DeleteProvisionedConcurrencyConfig	lambda	lambda:DeleteProvisionedConcurrencyConfig			Write
DeleteResourcePolicy	lambda	lambda:DeleteResourcePolicy			Permissions management, Write
DeleteResourcePolicy	lambda	lambda:RemovePermission			Permissions management, Write
GetAccountSettings	lambda	lambda:GetAccountSettings			Read
GetAlias	lambda	lambda:GetAlias			Read
GetCapacityProvider	lambda	lambda:GetCapacityProvider			Read
GetCodeSigningConfig	lambda	lambda:GetCodeSigningConfig			Read
GetDurableExecution	lambda	lambda:GetDurableExecution			Read
GetDurableExecutionHistory	lambda	lambda:GetDurableExecutionHistory			Read
GetDurableExecutionState	lambda	lambda:GetDurableExecutionState