CODEWITHSUNDEEP
amazon-web-servicesaws-lambdaamazon-vpcaws-iam-policy
Prasanjeet Mohanty
Prasanjeet Mohanty

Reputation: 31

Issue while adding VPC to AWS Lambda function: The provided execution role does not have permissions to call CreateNetworkInterface on EC2

So, something weird is happening which I can't seem to wrap my head around.

I have a lambda function, whose execution role has the AWS Managed AWSLambdaVPCAccessExecutionRole in it.

This role has ec2:CreateNetworkInterface action in it. But, when I try adding a vpc to the lambda, I get the error:

"The provided execution role does not have permissions to call CreateNetworkInterface on EC2"

As mentioned in many stack overflow threads, the AWSLambdaVPCAccessExecutionRole is part of the lambda function's execution role, not the IAM user's role. But still this issue comes up. I have a SystemAdministrator account through which I am trying to add the VPC. One of the things that we have tried so far:

This issue is coming up in the organization's prd account. With the similar setup, we were able to deploy it in non-prd account though.

If anyone has any advice to solve or triage this issue, then that would be great. Let me know if you need any additional details about the set up.

Upvotes: 0

Views: 38

Answers (1)

stdunbar
stdunbar

Reputation: 17535

I've run into this and it's frustrating that Amazon hasn't fixed this or at least documented how to work around it.

If you had AWS create the role that runs this Lambda then you have an "AWSLambdaBasicExecutionRole" that is used to run the Lambda. That has the CreateLogGroup, CreateLogStream, and PutLogEvents so that the Lambda can log. But when you put it into a VPC you need more. I have another role that contains:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeNetworkInterfaces"
            ],
            "Resource": "*"
        }
    ]
}

That allowed me to put the Lambda into a VPC and remove it from it. I find it interesting that you have to know that the Lambda must be deployed onto some EC2 somewhere and you need some permissions to update it.

Note that if you put the Lambda into the VPC right away then it automatically creates this role. But if you do it later then you have to have these permissions too.

Upvotes: 1

Related Questions