AWS::Lambda::Permission

Lambda Permission

The AWS::Lambda::Permission resource grants an AWS service or another account permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function. To grant permission to another account, specify the account ID as the Principal. To grant permission to an organization defined in...

Properties

9 configurable properties. 3 required. Click a row to see details.

Filter:

Property	Type	Flags
`Action`	`string`	RequiredCreate-only
`FunctionName`	`string`	RequiredCreate-only
`Principal`	`string`	RequiredCreate-only
`EventSourceToken`	`string`	Create-only
`FunctionUrlAuthType`	`string`	Create-only
`InvokedViaFunctionUrl`	`boolean`	Create-only
`PrincipalOrgID`	`string`	Create-only
`SourceAccount`	`string`	Create-only
`SourceArn`	`string`	Create-only

Return Values

Values returned after the resource is created. Access these with Fn::GetAtt.

Attribute	Type	Description
`Id`	`string`	-

Sample CloudFormation Template

A minimal template with required properties and common optional ones.

template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: Sample template for AWS::Lambda::Permission

Resources:
  MyResource:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: "my-functionname"
      Action: "value"
      Principal: "value"

Required IAM Permissions

Permissions CloudFormation needs in your IAM role to manage this resource.

create

lambda:AddPermission

read

lambda:GetPolicy

delete

lambda:RemovePermission

list

lambda:GetPolicy

Get the Lambda Cheat Sheet

Everything you need to know about Lambda on one page. HD quality, print-friendly.

Download Free Infographic

Quick Facts

ServiceLambda

Properties10

Required3

TaggingNot supported

Primary IDFunctionName

Supported Operations

CreateReadDeleteList

Immutable After Creation

These properties cannot be changed after the resource is created. Updating them triggers a replacement.

FunctionNameFunctionUrlAuthTypeInvokedViaFunctionUrlSourceAccountSourceArnPrincipalPrincipalOrgIDActionEventSourceToken

Related Resources

External Links

AWS Documentation