Borislav Hadzhiev
Last updated: Sep 28, 2021
Check out my new book
In order to grant a Lambda function access to an SSM parameter, we have to
attach an IAM policy to the function's execution role. The policy should grant
permissions for all the Actions
the function needs to perform on the SSM
parameter.
For example, the following policy grants permissions for the most commonly used Parameter Store actions on a specific parameter.
YOUR_*
placeholders in the Resource
element with the real values.Resource
list or just add *
which means your function has access to all of the parameters in the account.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": [ "arn:aws:ssm:YOUR_REGION:YOUR_ACCOUNT_NUMBER:parameter/PARAMETER_NAME_WITHOUT_LEADING_SLASH" ] } ] }
The Resource
element should look something like:
arn:aws:ssm:us-east-1:123456789:parameter/PARAMETER_NAME_WITHOUT_LEADING_SLASH
once the real values are in place.
/my-app/dev/db-url
it should be omitted when specifying the name in the Resource
element of the IAM policy - my-app/dev/db-url
.The actions your lambda function needs to perform on the SSM parameter are use case dependent.
You could set "ssm:*"
for the Action
element in the policy to grant full
parameter store access to the lambda function.
You could also set the Resource
element to be *
, which means the function
can access all SSM parameters in the account.
However, it's best practice to grant an entity the least permissions that get the job done.
You can view a full list of the Parameter Store Actions
in the
Systems Manager actions table.
There is a Description
column, which explains what each action does.
To attach a policy to the lambda function's execution role, you have to:
Configuration
tab and then click Permissions
Add permissions
and then click Create inline policy
JSON
editor paste the following policy.YOUR_*
placeholders and adjust the Actions
your lambda function needs to execute.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ssm:PutParameter", "ssm:DeleteParameter", "ssm:DeleteParameters" ], "Resource": [ "arn:aws:ssm:YOUR_REGION:YOUR_ACCOUNT_NUMBER:parameter/PARAMETER_NAME_WITHOUT_LEADING_SLASH" ] } ] }
Review Policy
and give your policy a name, then click Create policy
At this point the lambda function's role has been extended with a policy that grants access to some Parameter Store actions on a specific parameter.
Resource
element of the policy, or set the Resource
to *
.Invoke your lambda function and verify whether it has access to the SSM parameter.
If your function is still unable to access the SSM parameter, try to increase
the function's timeout
by a second in the AWS console or simply add an extra
print
statement in the code and click the Deploy
button.
If your lambda function still does not have access to the parameter, expand the IAM policy you added to the function's role and edit it to look like the policy below.
YOUR_*
placeholders with real values.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:*" ], "Resource": [ "arn:aws:ssm:YOUR_REGION:YOUR_ACCOUNT_NUMBER:parameter/PARAMETER_NAME_WITHOUT_LEADING_SLASH" ] } ] }
The IAM policy above grants full access to an SSM parameter. Your lambda function will be able to execute all Parameter store actions on the parameter.
*
symbol is useful when debugging.After you've updated the policy, try to invoke your lambda function again, it should have permissions to execute any action on the SSM parameter.
After you verify which actions your lambda needs to run, you can make the IAM policy less permissive.
Deny
effect will always override any Allow
statements.