Lambda Role Permission and Trust Policy for Assume role

Example

Account:  1234567890

Role name: LambdaIAMRoleEC2Scanner

Lambda Function name: ec2ScannerNewNew

Questions:

why still error An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::1234567890:assumed-role/LambdaIAMRoleEC2Scanner/ec2ScannerNewNew is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::1234567890:role/LambdaIAMRoleEC2Scanner I already put on lambda role with permission.

Answer:

Based on the error message you provided, it appears that the IAM user or role "arn:aws:sts::1234567890:assumed-role/LambdaIAMRoleEC2Scanner/ec2ScannerNewNew" does not have the necessary permissions to assume the role "arn:aws:iam::1234567890:role/LambdaIAMRoleEC2Scanner".

To resolve this issue, you need to ensure that the IAM user or role has the appropriate permissions to assume the role. Here are the steps you can take:

1. Check the trust policy of the role "LambdaIAMRoleEC2Scanner":

   • Go to the IAM service in the AWS Management Console.
   • Navigate to the "Roles" section.
   • Find and select the "LambdaIAMRoleEC2Scanner" role.
   • Click on the "Trust relationships" tab.
   • Verify that the trust policy allows the IAM user or role "arn:aws:sts::1234567890:assumed-role/LambdaIAMRoleEC2Scanner/ec2ScannerNewNew" to assume this role.

2. Check the permissions policy of the IAM user or role "arn:aws:sts::1234567890:assumed-role/LambdaIAMRoleEC2Scanner/ec2ScannerNewNew":

   • Go to the IAM service in the AWS Management Console.
   • Navigate to the "Users" or "Roles" section, depending on whether it is a user or a role.
   • Find and select the "arn:aws:sts::1234567890:assumed-role/LambdaIAMRoleEC2Scanner/ec2ScannerNewNew" user or role.
   • Click on the "Permissions" tab.
   • Ensure that the user or role has the necessary permissions to assume roles. Specifically, it should have the "sts:AssumeRole" permission on the resource "arn:aws:iam::1234567890:role/LambdaIAMRoleEC2Scanner".

3. Update the policies if necessary:

   • If the trust policy or permissions policy is not correctly configured, you may need to update them.
   • Modify the policy document to include the necessary permissions or trust relationships.
   • Once updated, save the changes.

By ensuring that both the trust policy and permissions policy are properly configured, you should be able to resolve the "AccessDenied" error when calling the AssumeRole operation.

Trust policy

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com", "AWS": [ "arn:aws:sts::1234567890:federated-user/aws@bagussa.internet", "arn:aws:sts::1234567890:assumed-role/LambdaIAMRoleEC2Record/ec2ScannerNewNew" ] }, "Action": "sts:AssumeRole" } ] }

Assume role policy

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Sid": "VisualEditor0",

            "Effect": "Allow",

            "Action": "sts:AssumeRole",

            "Resource": [

                "arn:aws:iam::1234567890:role/LambdaIAMRoleEC2Record",

                "arn:aws:iam::1234567890:role/*"

            ]

        }

    ]

}

And then you can add another permission for checking EC2 scanner for use case tool, that is just use case, you can use another as well.