CODEWITHSUNDEEP
amazon-web-servicesaws-lambdatagsamazon-iam
baggagescreen
baggagescreen

Reputation: 136

Granting access to AWS Lambda resources that have a given tag

I want to grant access to a group of users to perform certain operations on certain Lambda functions. My Lambdas are already tagged properly to allow this, for instance: "department:hr". Can I tie this together with IAM?

I have seen documentation on conditionals that allow comparison of ResourceTag\* to a value, but these do not seem to be available in the visual editor (which unfortunately I depend on) for Lambda functions.

I want something like this:

            "Effect": "Allow",
            "Action": [
                "lambda:ListFunctions",
                "lambda:ListVersionsByFunction",
                "lambda:GetLayerVersion",
                "lambda:GetEventSourceMapping",
                "lambda:GetFunction",
                "lambda:ListAliases",
                "lambda:GetAccountSettings",
                "lambda:GetFunctionConfiguration",
                "lambda:GetLayerVersionPolicy",
                "lambda:ListTags",
                "lambda:ListEventSourceMappings",
                "lambda:ListLayerVersions",
                "lambda:ListLayers",
                "lambda:GetAlias",
                "lambda:GetPolicy"
            ],
            "Resource": "*"
            "Condition": {
                "StringEquals": {
                    "lambda:ResourceTag/department": "hr"
                }

I can't build this in the visual editor and I get syntax errors when I attempt it myself.

Upvotes: 4

Views: 2104

Answers (2)

user2661738
user2661738

Reputation: 53

If your IAM users are tagged with department:hr and if they assume the below IAM role via console, they should be able to access the lambda functions that have been tagged with department:hr.

HRDepartmentLambdaFunctionsAccessRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: "HRDepartmentLambdaFunctionsAccessRole"
    AssumeRolePolicyDocument:
      # Allow users in account X to perform operations on lambda functions
      Statement:
        - Effect: Allow
          Principal:
            AWS:
              - "AWS_ACCOUNT_NUMBER"
          Action:
            - sts:AssumeRole
          Condition:
            StringEquals:
              aws:PrincipalTag/department:
                - hr
    Path: /
    Policies:
      - PolicyName: AllowAccessToLambdaFunctionsInHRDepartment
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - lambda:ListFunctions
            - lambda:ListVersionsByFunction
            - lambda:GetLayerVersion
            - lambda:GetEventSourceMapping
            - lambda:GetFunction
            - lambda:ListAliases
            - lambda:GetAccountSettings
            - lambda:GetFunctionConfiguration
            - lambda:GetLayerVersionPolicy
            - lambda:ListTags
            - lambda:ListEventSourceMappings
            - lambda:ListLayerVersions
            - lambda:ListLayers
            - lambda:GetAlias
            - lambda:GetPolicy       
            Resource: '*'
            Condition:
              StringEquals:
                lambda:ResourceTag/department: 'hr'

Ref: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html

Upvotes: -1

Ian Jenkins
Ian Jenkins

Reputation: 304

I don't believe that lambda:ResourceTag/${TagKey} is a context condition available for any lambda actions (REF: https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awslambda.html).

With that said, incorrect use of context keys typically fails silently. Could you include the full statement? For example, in the above snippet, there is a missing } for the condition.

Upvotes: 2

Related Questions