# Cannot access stream lambda serverless v.13

**URL:** <https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [November 30, 2016, 8:27pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859 "2016-11-30T20:27:03Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohitg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mohitg/32/320_2.png) [@mohitg](https://forum.serverless.com/u/mohitg)\
**Post date:** [November 30, 2016, 8:27pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/1 "2016-11-30T20:27:03Z")

</div>

Hi,

I am seeing the following error on doing serverless deploy

An error occurred while provisioning your stack: StreamFunctionEventSourceMappingDynamodbMyTable1  
- Cannot access stream arn:aws:dynamodb:us-east-1:XX:table/tabletest/stream/2016-11-07T17:00:04.145.  
Please ensure the role can perform the GetRecords, GetShardIterator,  
DescribeStream, and ListStreams Actions on your stream  
in IAM.

Here is my serverless.yaml. Please help

```
service: testservice

provider:
  name: aws
  runtime: nodejs4.3
  cfLogs: true
  stage: dev
  region: us-east-1

functions:
  Test1:
    handler: a.index
    name: test1
    role: arn:aws:iam:us-east-1:XX:role/lambda_dynamo
    description: test1
    memorySize: 512 # optional, default is 1024
    timeout: 60 # optional, default is 6
  Test2:
    handler: b.index
    name: test2
    role: arn:aws:iam:us-east-1:XX:role/lambda_dynamo
    description: test2
    memorySize: 512 # optional, default is 1024
    timeout: 60 # optional, default is 6
  Test3:
    handler: c.index
    name: test3
    role: arn:aws:iam:us-east-1:XX:role/lambda_dynamo
    description: test3
    memorySize: 512 # optional, default is 1024
    timeout: 60 # optional, default is 6

resources:
  Resources:
    StreamFunctionEventSourceMappingDynamodbMyTable1:
      Type: AWS::Lambda::EventSourceMapping
      DependsOn: IamPolicyLambdaExecution
      Properties:
        BatchSize: 100
        EventSourceArn: arn:aws:dynamodb:us-east-1:XX:table/tabletest/stream/2016-11-07T17:00:04.145
        FunctionName: test1
        StartingPosition: LATEST
        Enabled: True
    StreamFunctionEventSourceMappingDynamodbMyTable2:
      Type: AWS::Lambda::EventSourceMapping
      DependsOn: IamPolicyLambdaExecution
      Properties:
        BatchSize: 100
        EventSourceArn: arn:aws:dynamodb:us-east-1:XX:table/tabletest/stream/2016-11-07T17:00:04.145
        FunctionName: test2
        StartingPosition: LATEST
        Enabled: True
```

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [November 30, 2016, 9:48pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/2 "2016-11-30T21:48:38Z")

</div>

@mohitg Try adding the following

```auto
provider:
  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:DescribeStream
        - dynamodb:GetRecords
        - dynamodb:GetShardIterator
        - dynamodb:ListStreams

```

I’ll write a full post on getting DyanmoDB streams working when I get a chance.

---

<div class="post-metadata">

**Author:** ![mohitg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mohitg/32/320_2.png) [@mohitg](https://forum.serverless.com/u/mohitg)\
**Post date:** [November 30, 2016, 10:48pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/3 "2016-11-30T22:48:00Z")

</div>

Thanks Buggy.  
I added the following and was able to deploy the lambda’s. However, if the stream is different for each function, then how can multiple resource value be provided in the iamRoleStatements ?

```
iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:DescribeStream
        - dynamodb:GetRecords
        - dynamodb:GetShardIterator
        - dynamodb:ListStreams
      Resource: arn:aws:dynamodb:us-east-1:XX:table/XX/stream/2016-11-07T17:00:04.145
```

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [November 30, 2016, 10:56pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/4 "2016-11-30T22:56:39Z")

</div>

`iamRoleStatements` is an array of statements. Just add each stream.

```auto
iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:DescribeStream
        - dynamodb:GetRecords
        - dynamodb:GetShardIterator
        - dynamodb:ListStreams
      Resource: arn:aws:dynamodb:us-east-1:XX:table/XX/stream/2016-11-07T17:00:04.145
    - Effect: Allow
      Action:
        - dynamodb:DescribeStream
        - dynamodb:GetRecords
        - dynamodb:GetShardIterator
        - dynamodb:ListStreams
      Resource: arn:aws:dynamodb:us-east-1:XX:table/YY/stream/2016-11-07T17:00:04.145
    - Effect: Allow
      Action:
        - dynamodb:DescribeStream
        - dynamodb:GetRecords
        - dynamodb:GetShardIterator
        - dynamodb:ListStreams
      Resource: arn:aws:dynamodb:us-east-1:XX:table/ZZ/stream/2016-11-07T17:00:04.145

```

---

<div class="post-metadata">

**Author:** ![mohitg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mohitg/32/320_2.png) [@mohitg](https://forum.serverless.com/u/mohitg)\
**Post date:** [December 1, 2016, 3:54pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/5 "2016-12-01T15:54:12Z")

</div>

Thank You buggy. I see that the role provided at the function level is overriden after putting iamRoleStatements.  
Please let me know how can I still have the role: arn:aws:iam:us-east-1:XX:role/lambda\_dynamo  
(mentioned at function level) attached as well.  
The role generated by serverless, attached to all lambda’s is as below

```
{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Action":[
            "logs:CreateLogGroup",
            "logs:CreateLogStream"
         ],
         "Resource":[
            "arn:aws:logs:us-east-1:XX:log-group:/aws/lambda/test1:*",
            "arn:aws:logs:us-east-1:XX:log-group:/aws/lambda/test2:*",
            "arn:aws:logs:us-east-1:XX:log-group:/aws/lambda/test3:*"
         ],
         "Effect":"Allow"
      },
      {
         "Action":[
            "logs:PutLogEvents"
         ],
         "Resource":[
            "arn:aws:logs:us-east-1:XX:log-group:/aws/lambda/test1:*:*",
            "arn:aws:logs:us-east-1:XX:log-group:/aws/lambda/test2:*:*",
            "arn:aws:logs:us-east-1:XX:log-group:/aws/lambda/test3:*:*"
         ],
         "Effect":"Allow"
      },
      {
         "Action":[
            "dynamodb:DescribeStream",
            "dynamodb:GetRecords",
            "dynamodb:GetShardIterator",
            "dynamodb:ListStreams"
         ],
         "Resource":"arn:aws:dynamodb:us-east-1:XX:table/tabletest/stream/2016-11-07T17:00:04.145",
         "Effect":"Allow"
      }
   ]
}
```

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [December 1, 2016, 11:37pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/6 "2016-12-01T23:37:18Z")

</div>

The same principle applies. You just need to add the IAM role statements to your custom roles.

Assuming you’re doing this as resources in your serverless.yml you can look at AssumeRolePolicyDocument in [http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html) for an example.

---

<div class="post-metadata">

**Author:** ![mohitg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mohitg/32/320_2.png) [@mohitg](https://forum.serverless.com/u/mohitg)\
**Post date:** [December 2, 2016, 4:27am UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/7 "2016-12-02T04:27:56Z")

</div>

Thanks for your reply. However, I wanted to use role ARN at function level instead of custom roles.  
Also, If I define custom roles, I will not be able to share the custom role across multiple services.

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [December 2, 2016, 10:33am UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/8 "2016-12-02T10:33:54Z")

</div>

> [@mohitg](#):
>
> However, I wanted to use role ARN at function level instead of custom roles

Those `role: arn:aws:iam:us-east-1:XX:role/lambda_dynamo` that you’re adding to the function are what I’m referring to. You need to add the role statements to those. If you’re creating and managing them outside of Serverless then you need to add the statements outside of Serverless too.

---

<div class="post-metadata">

**Author:** ![mohitg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mohitg/32/320_2.png) [@mohitg](https://forum.serverless.com/u/mohitg)\
**Post date:** [December 2, 2016, 8:57pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/9 "2016-12-02T20:57:46Z")

</div>

Hi buggy,

I have updated the role created externally with IAM role statements and updated the serverless framework to v1.3. Now, I see new error on deploying:

```
Template format error: Unresolved resource dependencies
     [IamPolicyLambdaExecution] in the Resources block of
     the template

```

Here is my updated serverless.yaml

```
service: testservice

provider:
  name: aws
  runtime: nodejs4.3
  cfLogs: true
  stage: dev
  region: us-east-1

functions:
  Test1:
    handler: a.index
    name: test1
    role: arn:aws:iam:us-east-1:XX:role/lambda_dynamo
    description: test1
    memorySize: 512 # optional, default is 1024
    timeout: 60 # optional, default is 6
  Test2:
    handler: b.index
    name: test2
    role: arn:aws:iam:us-east-1:XX:role/lambda_dynamo
    description: test2
    memorySize: 512 # optional, default is 1024
    timeout: 60 # optional, default is 6
  Test3:
    handler: c.index
    name: test3
    role: arn:aws:iam:us-east-1:XX:role/lambda_dynamo
    description: test3
    memorySize: 512 # optional, default is 1024
    timeout: 60 # optional, default is 6

resources:
  Resources:
    StreamFunctionEventSourceMappingDynamodbMyTable1:
      Type: AWS::Lambda::EventSourceMapping
      DependsOn: IamPolicyLambdaExecution
      Properties:
        BatchSize: 100
        EventSourceArn: arn:aws:dynamodb:us-east-1:XX:table/tabletest/stream/2016-11-07T17:00:04.145
        FunctionName: test1
        StartingPosition: LATEST
        Enabled: True
    StreamFunctionEventSourceMappingDynamodbMyTable2:
      Type: AWS::Lambda::EventSourceMapping
      DependsOn: IamPolicyLambdaExecution
      Properties:
        BatchSize: 100
        EventSourceArn: arn:aws:dynamodb:us-east-1:XX:table/tabletest/stream/2016-11-07T17:00:04.145
        FunctionName: test2
        StartingPosition: LATEST
        Enabled: True
```

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [December 4, 2016, 5:36am UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/10 "2016-12-04T05:36:21Z")

</div>

I’ll probably start upgrading to 1.3 later this week. Once I do I’ll have a look at this again.

---

<div class="post-metadata">

**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\
**Post date:** [December 7, 2016, 8:16am UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/11 "2016-12-07T08:16:51Z")

</div>

FWIW `Resource` takes either a single value [or an array of values](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Resource) - you don’t need to repeat the whole policy statement for each ARN.

---

<div class="post-metadata">

**Author:** ![mohitg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mohitg/32/320_2.png) [@mohitg](https://forum.serverless.com/u/mohitg)\
**Post date:** [December 7, 2016, 4:07pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/12 "2016-12-07T16:07:24Z")

</div>

Hi rowanu,

I am repeating the StreamFunctionEventSourceMapping in the Resources as I required mapping for 2 different functions.

Let me know if you thoughts.

---

<div class="post-metadata">

**Author:** ![mohitg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mohitg/32/320_2.png) [@mohitg](https://forum.serverless.com/u/mohitg)\
**Post date:** [December 12, 2016, 4:20pm UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/13 "2016-12-12T16:20:23Z")

</div>

Hi buggy,

Please let me know if you are seeing similar issue after upgrade.

---

<div class="post-metadata">

**Author:** ![mohitg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mohitg/32/320_2.png) [@mohitg](https://forum.serverless.com/u/mohitg)\
**Post date:** [December 19, 2016, 4:16am UTC](https://forum.serverless.com/t/cannot-access-stream-lambda-serverless-v-13/859/14 "2016-12-19T04:16:42Z")

</div>

Hi buggy,

Let me know if you are able to see the issue.