# Allow any lambda to invoke lambda with resource policy?

**URL:** <https://forum.serverless.com/t/allow-any-lambda-to-invoke-lambda-with-resource-policy/2903>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [October 16, 2017, 3:36pm UTC](https://forum.serverless.com/t/allow-any-lambda-to-invoke-lambda-with-resource-policy/2903 "2017-10-16T15:36:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bglick](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bglick/32/755_2.png) [@bglick](https://forum.serverless.com/u/bglick)\
**Post date:** [October 16, 2017, 3:36pm UTC](https://forum.serverless.com/t/allow-any-lambda-to-invoke-lambda-with-resource-policy/2903/1 "2017-10-16T15:36:14Z")

</div>

Has anyone had any luck attaching a resource policy to a lambda to allow other lambdas to invoke it?

Basically, we have a lambda that is doing some basic logging type work and we want to allow any other lambda in our account to invoke it via an internal library without having to explicitly reference it in each lambda’s `iamRoleStatements`

I would have thought that this would have taken care of it, but my other lambdas running in the same account are still failing with error:

```auto
AccessDeniedException: User: arn:aws:sts::XXXXXX:assumed-role/chainioUpdShipEventsAdapter-dev-us-east-1-lambdaRole/chainioUpdShipEventsAdapter-dev-handler 
is not authorized to perform: 
lambda:InvokeFunction on resource: arn:aws:lambda:us-east-1:XXXXXX:function:chainioEventStreamWriter-dev-handler

```

Current resource setting in serverless.yml for `chainioEventStreamWriter`

```auto
resources:
  Resources:
    StreamWriterLambdaPermission:
      Type: AWS::Lambda::Permission
      Properties:
        FunctionName:
          Ref: HandlerLambdaFunction
        Action: 'lambda:invokeFunction'
        Principal: '*'
        SourceAccount: ${self:custom.${opt:stage}.aws_account}

```

Seems related to: [Async Lambda invoke from another Lambda](http://forum.serverless.com/t/async-lambda-invoke-from-another-lambda/1417/14)

---

<div class="post-metadata">

**Author:** ![alexdebrie1](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/alexdebrie1/32/899_2.png) [@alexdebrie1](https://forum.serverless.com/u/alexdebrie1)\
**Post date:** [October 16, 2017, 9:07pm UTC](https://forum.serverless.com/t/allow-any-lambda-to-invoke-lambda-with-resource-policy/2903/2 "2017-10-16T21:07:40Z")

</div>

Hi @bglick! So I did some testing with this, and I think the `SourceAccount` property is preventing it. From the [docs](http://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html#API_AddPermission_RequestBody), it says `SourceAccount` “is used for S3 and SES.”

That being said, I haven’t had any luck scoping to permissions down to my account. I’ve tried using the `SourceArn` property with something like `arn:aws:lambda:us-east-1:<myId>:function:*`. I also tried setting `Principal: "lambda.amazonaws.com"`. Neither one worked.

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [October 18, 2017, 6:08am UTC](https://forum.serverless.com/t/allow-any-lambda-to-invoke-lambda-with-resource-policy/2903/3 "2017-10-18T06:08:43Z")

</div>

> [@bglick](#):
>
> Basically, we have a lambda that is doing some basic logging type work and we want to allow any other lambda in our account to invoke it via an internal library without having to explicitly reference it in each lambda’s iamRoleStatements

This sounds like a really bad use of one Lambda calling another Lambda. It would be better to implement logging as a library then use that inside your other Lambda’s without invoking a second Lambda. If you can’t do that then I would look at attaching your logging Lambda to a Kinesis stream and have the main Lambda put messages onto the stream when logging is required.

---

<div class="post-metadata">

**Author:** ![bglick](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bglick/32/755_2.png) [@bglick](https://forum.serverless.com/u/bglick)\
**Post date:** [October 18, 2017, 10:10pm UTC](https://forum.serverless.com/t/allow-any-lambda-to-invoke-lambda-with-resource-policy/2903/4 "2017-10-18T22:10:02Z")

</div>

Yeah, I simplified the use case a bit.

We actually are using this to wrap a kinesis stream because we don’t want to leak the stream details into 50+ microservices which we would have to change if we decide to change the way we’re partitioning the stream or if we move to a different underlying implementation. Basically we want to have one service (Lambda) that the other services invoke and encapsulate the stream details in the single lambda.

---

<div class="post-metadata">

**Author:** ![mungojam](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mungojam/32/3510_2.png) [@mungojam](https://forum.serverless.com/u/mungojam)\
**Post date:** [July 30, 2019, 2:12pm UTC](https://forum.serverless.com/t/allow-any-lambda-to-invoke-lambda-with-resource-policy/2903/5 "2019-07-30T14:12:00Z")

</div>

The only way I could get this to work was with public access, i.e. Principal: \*, which I quickly tried with a dummy lambda. As soon as I tried SourceArn or SourceAccount I hit the same AccessDenied error

This also seems to prevent cross-account lambda calling unless we assume a role in the target account