I have 2 lambdas in 2 different aws accounts as the following:
Lambda A:
- In AWS account# 111
- has RoleA with the following polices:
- access to s3,
- secret manager
3- allow RoleB to invoke it
Lambda B:
- In AWS account# 222
- has RoleB with the following polices:
- Assume Role
- Invoke Lambda
When LambdaB gets the assume role token, the tokens can do:
- Invoke the lambdaA (Ok , this is needed)
- Acess to 111 s3 !!!! (why!)
- Acess to 111 secrets !!!! (why!)
How to ONLY allow lambdaB use the tokens for ONLY invoking the function. Not have full access to all of **RoleA **?
users have access all role polices, i want the user only to invoke the function
if my understanding is correct, your main objective is to invoke lambda A through lambda B. Correct me if this is not the case.
If this is the case, you can use resource based policies in the lambda function A to allow invoke by role attached/used by Lambda B. This avoids allowing roleB to assume roleA (role from lambda A).
So if you go into the lambda console for lambda A, and go to “Configuration”->”Permissions”->”Resource-based policy”->”View policy document”. Then you can use something like the following:
{
"Version": "2012-10-17",
"Id": "default",
"Statement": [
{
"Sid": "lambda-allow-lambdaB-to-invoke",
"Effect": "Allow",
"Principal": {
"AWS": "full-arn-of-roleB-used-in-lambda-B"
},
"Action": "lambda:InvokeFunction",
"Resource": "full-arn-of-lambdaA"}
}
}
]
}
With this, inside your lambdaB, you can use the boto3 lambda client to invoke lambdaA, and the permissions for lambdaB will still be limited to only the roleB, as it wont be assuming any role (roleA).