Set up IAM permissions and roles for Lambda@Edge (original) (raw)

To configure Lambda@Edge, you must have the following IAM permissions and roles for AWS Lambda:

IAM permissions required to associate Lambda@Edge functions with CloudFront distributions

In addition to the IAM permissions that you need for Lambda, you need the following permissions to associate Lambda functions with CloudFront distributions:

Important

You must add the asterisk (*) at the end of thelambda:EnableReplication***** and lambda:DisableReplication***** actions.

For more information, see the following topics:

Function execution role for service principals

You must create an IAM role that the lambda.amazonaws.com andedgelambda.amazonaws.com service principals can assume when they execute your function.

For more information about creating an IAM role manually, see Creating roles and attaching policies (console) in the IAM User Guide.

Example: Role trust policy

You can add this role under the Trust Relationship tab in the IAM console. Don't add this policy under thePermissions tab.

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": {
            "Service": [
               "lambda.amazonaws.com",
               "edgelambda.amazonaws.com"
            ]
         },
         "Action": "sts:AssumeRole"
      }
   ]
}

For more information about the permissions that you need to grant to the execution role, see Lambda resource access permissions in the_AWS Lambda Developer Guide_.

Notes

Service-linked roles for Lambda@Edge

Lambda@Edge uses IAM service-linked roles. A service-linked role is a unique type of IAM role that is linked directly to a service. Service-linked roles are predefined by the service and include all of the permissions that the service requires to call other AWS services on your behalf.

Lambda@Edge uses the following IAM service-linked roles:

A service-linked role makes setting up and using Lambda@Edge easier because you don’t have to manually add the necessary permissions. Lambda@Edge defines the permissions of its service-linked roles, and only Lambda@Edge can assume the roles. The defined permissions include the trust policy and the permissions policy. You can't attach the permissions policy to any other IAM entity.

You must remove any associated CloudFront or Lambda@Edge resources before you can delete a service-linked role. This helps protect your Lambda@Edge resources so that you don't remove a service-linked role that is still required to access active resources.

For more information about service-linked roles, see Service-linked roles for CloudFront.

Service-linked role permissions for Lambda@Edge

Lambda@Edge uses two service-linked roles, named AWSServiceRoleForLambdaReplicator andAWSServiceRoleForCloudFrontLogger. The following sections describe the permissions for each of these roles.

Contents

Service-linked role permissions for Lambda replicator

This service-linked role allows Lambda to replicate Lambda@Edge functions to AWS Regions.

The AWSServiceRoleForLambdaReplicator service-linked role trusts the replicator.lambda.amazonaws.com service to assume the role.

The role permissions policy allows Lambda@Edge to complete the following actions on the specified resources:

Service-linked role permissions for CloudFront logger

This service-linked role allows CloudFront to push log files into CloudWatch so that you can debug Lambda@Edge validation errors.

The AWSServiceRoleForCloudFrontLogger service-linked role trusts the logger.cloudfront.amazonaws.com service to assume the role.

The role permissions policy allows Lambda@Edge to complete the following actions on the specified arn:aws:logs:*:*:log-group:/aws/cloudfront/* resource:

You must configure permissions to allow an IAM entity (such as a user, group, or role) to delete the Lambda@Edge service-linked roles. For more information, see Service-linked role permissions in the_IAM User Guide_.

Creating service-linked roles for Lambda@Edge

You don’t typically manually create the service-linked roles for Lambda@Edge. The service creates the roles for you automatically in the following scenarios:

To manually create these service-linked roles, you can run the following AWS Command Line Interface (AWS CLI) commands:

To create the AWSServiceRoleForLambdaReplicator role
aws iam create-service-linked-role --aws-service-name replicator.lambda.amazonaws.com
To create the AWSServiceRoleForCloudFrontLogger role
aws iam create-service-linked-role --aws-service-name logger.cloudfront.amazonaws.com

Editing Lambda@Edge service-linked roles

Lambda@Edge doesn't allow you to edit the AWSServiceRoleForLambdaReplicator or AWSServiceRoleForCloudFrontLogger service-linked roles. After the service has created a service-linked role, you can't change the name of the role because various entities might reference the role. However, you can use IAM to edit the role description. For more information, see Editing a service-linked role in the_IAM User Guide_.

Supported AWS Regions for Lambda@Edge service-linked roles

CloudFront supports using service-linked roles for Lambda@Edge in the following AWS Regions: