AWS First Steps
New feature

AWS Lambda now supports full IAM resource-based policies

AWS Lambda supports full IAM resource-based policies, allowing multiple principals and actions in a single policy document

AWS Lambda now supports full Identity and Access Management (IAM) resource-based policies. This enables platform admins and security teams to define granular access permissions using the full capabilities of AWS IAM. Previously, Lambda functions required customers to add permissions individually per principal, offering limited flexibility. The new support includes the full range of IAM condition keys, providing broader policy capabilities and streamlining management for multi-account architectures. For example, you can now restrict access based on source IP or principal tags, and allow multiple services to invoke a function with a single policy. You can update resource-based policies using the JSON editor in the AWS Lambda console, AWS CLI, AWS SDK, or infrastructure as code tools such as AWS CloudFormation and AWS SAM. Full IAM resource-based policies are available in all AWS commercial regions at no additional charge.

Why it matters

This update is useful for platform admins and security teams who need more detailed management of Lambda function access permissions

Read the original AWS announcement

Related articles and terms

AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policiesDesigning Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.AWS IAM Fine-Grained Access Control - How Policy-Based Design Achieves the Principle of Least PrivilegeExplore the design philosophy behind AWS IAM's policy-based access control and compare its granularity with Azure RBAC and GCP IAM in concrete terms.IAM Policy Evaluation Logic Explained - How Implicit Deny Loses to Explicit AllowA step-by-step explanation of how IAM evaluates requests to allow or deny them, covering the priority of implicit deny, explicit allow, and explicit deny, as well as intersection logic for SCPs, permission boundaries, and session policies.IAM Access AnalyzerA service that automatically analyzes resource policies on S3 buckets, IAM roles, and more to detect external access and unused permissions, strengthening your security posture