Explain the role of IAM roles in AWS Lambda.

Official answer

An IAM role is an assumable identity, not itself a permissions policy or a long-lived access key. Lambda assumes the function's execution role and uses temporary credentials for permitted AWS API calls.

The role has two distinct parts:

• Its trust policy permits the Lambda service principal, lambda.amazonaws.com, to assume it.
• Attached/inline permissions policies specify allowed actions and resources, subject to other applicable policy controls and explicit denies.

For an image processor, grant only the required input-object reads, output writes and logging operations, plus any necessary KMS permissions. The function normally uses the SDK credential provider rather than embedding keys or manually assuming its own execution role.

These permissions describe what the executing function can do. They do not automatically grant S3, a user or another function permission to invoke it. Invocation permissions and event-source configuration must be established separately.

Review roles per workload, avoid broad administrator access and test both permitted and forbidden calls. The deployment identity also needs appropriately scoped permission to pass the chosen role; control who can alter the function or role because that can change effective access.

Execution-role identity and trust, resource-based invocation policies