highFoundationSymptom-first#lambda#iam#role#not-authorized

Lambda execution role not authorized — invoke fails

Invoke returns 403 'The provided execution role does not have permissions'

Likely source:securityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Invoke returns 403 'The provided execution role does not have permissions'
  • Function logs spam with Permission denied / AccessDenied on AWS calls
  • Works in dev but fails in prod — different role ARN

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Configured role

    aws lambda get-function-configuration --function-name <FUNCTION> --query 'Role'

  • Role trust + policies

    aws iam get-role --role-name <ROLE-NAME> --query 'Role.{Arn:Arn,Trust:AssumeRolePolicyDocument}'

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • CloudWatch logs show AccessDenied on the failing AWS call
  • Role has only the basic execution policy

Confirm before fixing

aws logs filter-log-events --log-group-name /aws/lambda/<FUNCTION> --filter-pattern 'AccessDenied' --query 'events[0].message'
READ

Find the denied action in logs

Fix

aws iam attach-role-policy --role-name <ROLE-NAME> --policy-arn arn:aws:iam::aws:policy/<SERVICE-ACCESS-POLICY>
CHANGE

Attach the required service policy (e.g., AWSLambdaS3ExecutionRole, AmazonDynamoDBFullAccess)

Expected: Policy attached

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
aws lambda get-function-configuration --function-name <FUNCTION> --query 'Role'
READ

Know the role

2
aws iam get-role --role-name <ROLE-NAME> --query 'Role.AssumeRolePolicyDocument'
READ

Trust OK?

3
aws iam attach-role-policy --role-name <ROLE-NAME> --policy-arn arn:aws:iam::aws:policy/<SERVICE-POLICY>
CHANGE

Fix the missing permission

4
aws lambda invoke --function-name <FUNCTION> --payload '{}' /dev/stdout
READ

Re-invoke and watch logs until it clears

Expected: The function's output (200) or a resolved error

Prevention

  • Grant least-privilege per function and document the role↔services matrix.
  • Emit IAM Access Denied alarms from the function's log group.
  • Automate role creation in IaC so dev/prod roles never drift.

Related runbooks

Same stack, same failure family — worth a skim.

Lambda function timing out — exceeded configured timeouthigh

CloudWatch log line: 'Task timed out after X seconds'

AWSIntermediateRED3 causes
Open runbook
Lambda error retry storm — DLQ fillinghigh

Each poisoned event processed twice (synchronous + async retry)

AWSProductionRED2 causes
Open runbook
New IAM role says 'not authorized' — propagation delaymedium

Freshly created role fails with AccessDenied/not authorized

AWSFoundation2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.