amazon-web-serviceslambdavpc

aws lambda update-function-configuration receives AccessDeniedException

I want to grant vpc access for my lambda function. I use the following aws cli command.

aws lambda update-function-configuration \
--function-name SampleFunction \
--vpc-config SubnetIds=subnet-xxxx,SecurityGroupIds=sg-xxxx

But I receive the following error:

An error occurred (AccessDeniedException) when calling the UpdateFunctionConfiguration operation: Your access has been denied by EC2, please make sure your request credentials have permission to DescribeSecurityGroups for sg-xxxx. EC2 Error Code: UnauthorizedOperation. EC2 Error Message: You are not authorized to perform this operation.

I have granted the following permission to both my lambda role and the user who execute the aws command.

    - "ec2:CreateNetworkInterface"
    - "ec2:DescribeNetworkInterfaces"
    - "ec2:DeleteNetworkInterface"
    - "ec2:DescribeSecurityGroups"

I further tried to grant full access to both the lambda role and the user. But still received the same error

Can anyone suggest what else I can try?

Solution

  • Your users IAM policy needs further permissions.

    For example ec2:CreateSecurityGroup & etc. Have a look at this documentation to add requred permissions.