DevOps

Lambda IAM Policy Generator

Generate secure IAM execution role policies for AWS Lambda functions with CloudWatch Logs, S3, DynamoDB, and SQS access patterns.

Quick Policy Templates

AWS Service

Allowed Actions

Resource ARNs

arn:aws:logs:*:*:*

Least Privilege Verified

Policy statements are explicitly scoped to designated AWS actions and Resource ARNs.

Generated IAM Policy JSON

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowLogsAccess",
      "Effect": "Allow",
      "Action": "logs:CreateLogGroup",
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

Lambda IAM Policy Generator: Complete Guide

Lambda Execution Role: Minimum Required Permissions

Every Lambda function needs baseline CloudWatch Logs permissions to write execution logs. Without these, your function runs but produces no observable logs, making debugging impossible.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCloudWatchLogging",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

IAM Policy Generators for Other AWS Services

S3 Bucket IAM Policy Generator DynamoDB IAM Policy Generator EC2 IAM Policy Generator All Services →

How to Use

1
Service Pre-Selected
This page has pre-configured the generator for Lambda. Adjust actions and Resource ARNs as needed.
2
Select Allowed Actions
Click the action tags to toggle specific API permissions on or off. Add custom actions if needed.
3
Specify Resource ARNs
Enter exact Amazon Resource Names to enforce the Principle of Least Privilege.
4
Verify & Copy
Check the real-time security audit badge for wildcard warnings, then copy the formatted JSON policy.

Frequently Asked Questions

What IAM permissions does a Lambda function need?+

At minimum, every Lambda function needs CloudWatch Logs permissions: 'logs:CreateLogGroup', 'logs:CreateLogStream', and 'logs:PutLogEvents'. Beyond that, add only the specific actions your function uses (e.g., s3:GetObject for reading from S3, dynamodb:PutItem for writing to DynamoDB).

What is a Lambda execution role?+

A Lambda execution role is an IAM role that the Lambda service assumes when running your function. It defines what other AWS services your function code can access. AWS creates a basic execution role automatically, but you should customize it to follow least privilege.