👀 Views: 236 💬 Answers: 1 📅 Created: 2025-06-12

terraform aws iam lambda hcl

I'm performance testing and I'm having a hard time understanding I'm currently working with a question while trying to attach an IAM policy to an AWS Lambda function using Terraform. I've set up a permission boundary for my IAM roles, but when I apply the configuration, I receive the following behavior message: ``` behavior: updating IAM Role (my_lambda_role): InvalidParameterValue: The policy attached to the role exceeds the allowed permissions. ``` I suspect this is related to the permissions granted in my permission boundary, which is defined as follows: ```hcl resource "aws_iam_policy" "permission_boundary" { name = "LambdaPermissionBoundary" description = "Permission boundary for Lambda roles" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Effect = "Allow" Action = "lambda:*" Resource = "*" } ] }) } ``` When I create the IAM role for my Lambda function, I attach this policy as a permission boundary, along with a separate policy granting access to specific S3 buckets: ```hcl resource "aws_iam_role" "lambda_role" { name = "my_lambda_role" assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [ { Effect = "Allow" Principal = { Service = "lambda.amazonaws.com" }, Action = "sts:AssumeRole" } ] }) permissions_boundary = aws_iam_policy.permission_boundary.arn } resource "aws_iam_policy_attachment" "lambda_policy_attachment" { name = "LambdaS3PolicyAttachment" roles = [aws_iam_role.lambda_role.name] policy_arn = aws_iam_policy.s3_access_policy.arn } ``` I've double-checked that the policy attached to the role doesn’t exceed the permissions allowed by the boundary, but I still encounter the behavior. I also verified that my Lambda execution role has the necessary permissions to access the S3 resources with the following policy: ```hcl resource "aws_iam_policy" "s3_access_policy" { name = "LambdaS3AccessPolicy" description = "Allows Lambda function to access S3 buckets" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Effect = "Allow" Action = ["s3:GetObject", "s3:PutObject"] Resource = ["arn:aws:s3:::my-bucket/*"] } ] }) } ``` I've tried modifying the permission boundary to allow specific actions like `s3:GetObject` and `s3:PutObject`, but the behavior continues. What could be causing this scenario? Is there a specific way the permissions should be structured within the boundary that I'm overlooking? I'm using Hcl stable in this project. Any suggestions would be helpful. My team is using Hcl for this application. Any ideas how to fix this?