Understanding AWS Lambda Execution Role

Official answer

An execution role is an IAM role that Lambda assumes to give running function code temporary credentials. Its trust policy permits the Lambda service to assume it; its permissions policies control what the function can do to other resources.

For an upload processor, grant the required read action on the input bucket's object prefix and write action on the output prefix, plus the necessary logging permissions. Reading objects and listing a bucket are different actions with different resource scopes. Add database, secret or key permissions only when the workflow needs them. VPC attachment and some event source mappings require additional service-specific permissions.

This role does not decide who may invoke the function. Invocation authorization uses the caller's permissions and, where applicable, the function's resource-based policy. For example, an S3 notification needs permission for S3 to invoke the function; that is separate from the function's role permission to read an object.

Use separate roles where workloads require different privileges, avoid static AWS access keys, and narrow policies after reviewing actual access needs. Validate both allowed and denied operations. IAM Access Analyzer and policy review help, but do not replace testing the complete configured resource and key policies.

Execution roles, resource-based policies