# AWS Lambda and IAM error on deploy: The role defined for the function cannot be assumed by Lambda

**URL:** <https://forum.serverless.com/t/aws-lambda-and-iam-error-on-deploy-the-role-defined-for-the-function-cannot-be-assumed-by-lambda/9034>\
**Category:** Serverless Framework\
**Tags:** aws, lambda, iam\
**Created:** [August 9, 2019, 8:56pm UTC](https://forum.serverless.com/t/aws-lambda-and-iam-error-on-deploy-the-role-defined-for-the-function-cannot-be-assumed-by-lambda/9034 "2019-08-09T20:56:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![matteoh](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@matteoh](https://forum.serverless.com/u/matteoh)\
**Post date:** [August 9, 2019, 8:56pm UTC](https://forum.serverless.com/t/aws-lambda-and-iam-error-on-deploy-the-role-defined-for-the-function-cannot-be-assumed-by-lambda/9034/1 "2019-08-09T20:56:40Z")

</div>

In my AWS project, I use the serverless framework to deploy lambda function and IAM roles.

So I created 6 lambda functions, all using the same IAM Role below:

```
functions:

  auto-delete-identity:
    handler: src/auto-delete-identity.handler
    role: arn:aws:iam::123456789012:role/lambdaIAMRole
    name: auto-delete-identity

  auto-move-to-user-group:
    handler: src/auto-move-to-user-group.handler
    role: arn:aws:iam::123456789012:role/lambdaIAMRole
    name: auto-move-to-user-group
    
  auto-validate-user-creation:
    handler: src/auto-validate-user-creation.handler
    role: arn:aws:iam::123456789012:role/lambdaIAMRole
    name: auto-validate-user-creation
    
  auto-validation-user-email-modification:
    handler: src/auto-validation-user-email-modification.handler
    role: arn:aws:iam::123456789012:role/lambdaIAMRole
    name: auto-validation-user-email-modification
    
  hello-demo:
    handler: src/hello-demo.handler
    role: arn:aws:iam::123456789012:role/lambdaIAMRole
    name: hello-demo

  reset-user-password:
    handler: src/reset-user-password.handler
    role: arn:aws:iam::123456789012:role/lambdaIAMRole
    name: reset-user-password
  
resources:

  Resources:

    lambdaIAMRole:
      Type: "AWS::IAM::Role"
      Properties:
        RoleName: lambdaIAMRole
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Action:
                - "sts:AssumeRole"
              Effect: "Allow"
              Principal:
                Service:
                  - "lambda.amazonaws.com"
        Policies:
          - PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Action:
                    - "logs:CreateLogGroup"
                    - "logs:CreateLogStream"
                    - "logs:PutLogEvents"
                  Effect: "Allow"
                  Resource:
                    - !Sub "arn:aws:logs:eu-central-1:123456789012:log-group:/aws/lambda/*:*"
        PolicyName: "myLambdaPolicy"

```

When I deploy using the serverless deploy command, I sometimes got the following error:

```
An error occurred: HelloDashdemoLambdaFunction - The role defined for the function cannot be assumed by Lambda. (Service: AWSLambdaInternal; Status Code: 400; Error Code: InvalidParameterValueException; Request ID: 4099072a-809d-4f1c-b83e-7f4f5dd5170b).

```

It looks like a random bug, since it doesn’t occurs everytime. Also, when it occurs, it doesn’t always occurs on the same function.

Did I do something wrong? How can I fix that?

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![matteoh](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@matteoh](https://forum.serverless.com/u/matteoh)\
**Post date:** [August 10, 2019, 9:05am UTC](https://forum.serverless.com/t/aws-lambda-and-iam-error-on-deploy-the-role-defined-for-the-function-cannot-be-assumed-by-lambda/9034/2 "2019-08-10T09:05:06Z")

</div>

I fixed this by replacing

```
arn:aws:iam::123456789012:role/lambdaIAMRole

```

with

```
lambdaIAMRole
```

---

<div class="post-metadata">

**Author:** ![IamGabrielWu](https://avatars.discourse-cdn.com/v4/letter/i/9de0a6/32.png) [@IamGabrielWu](https://forum.serverless.com/u/IamGabrielWu)\
**Post date:** [September 25, 2020, 5:41am UTC](https://forum.serverless.com/t/aws-lambda-and-iam-error-on-deploy-the-role-defined-for-the-function-cannot-be-assumed-by-lambda/9034/3 "2020-09-25T05:41:10Z")

</div>

I met this problem as well.  
What i found is some race condition between IAM role and lambda.

```auto
service: xxx
custom:

  ...
  iamRole: xxx
  roleName: xxx
provider:
  name: aws
  runtime: nodejs12.x
  stage: xxx
  region: xxx
  role: ${self:custom.iamRole}
functions:
  processor:
    name: ${self:custom.lambda.name}
    handler: handler
    memorySize: 128
    timeout: 90
    events:
    - sqs:
        arn: ${self:custom.sqs}
        batchSize: 1
resources:
  Resources:
    lambdaRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: sqsAccess
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: ["sqs:DeleteMessage","sqs:ChangeMessageVisibility","sqs:ReceiveMessage","sqs:GetQueueAttributes","sqs:SendMessage"]
                  Resource:
                  ....
        ManagedPolicyArns:
          - ${self:custom.slsLogPolicy}
        RoleName: ${self:custom.roleName}

```

It seems IAM role takes longer to be created and lambda is set to use the role that is not fully ready.  
I changed the provider.role to be lambdaRole. It seems to fix the dependency or race condition issue.

```auto
provider:
  name: aws
  runtime: nodejs12.x
  stage: xxx
  region: xxx
  role: lambdaRole

```