AWS Lambda - The role defined for the function cannot be assumed by Lambda

Question

I am trying to access Lambda function using iOS Swift and here is my set up AWS Role

RoleName: ALLOW_LAMBDA_EXECUTE
- With Policy access to AWS Lambda full access, AWS Lambda execute, AmazonCognitoDeveloperAuthenticatedIdentities
- Trust Relationship: Allow services: lambda.amazonaws.com and condition has Cognito identity with "unauthenticated"
Cognito Identity Pool: Has the role ALLOW_LAMBDA_EXECUTE under unauthenticated role
Unauthenticated Identities: Has Enable access to unauthenticated identities checked
In Lambda, for function GetProcess(), has ExecutionRole: ALLOW_LAMBDA_EXECUTION

with all these, when I execute the same using my iPhone app (with simulator), I get this error.

"x-amzn-errortype" = **AccessDeniedException**;

-[AWSJSONResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response body:
**{"Message":"The role defined for the function cannot be assumed by Lambda."}**

Am I missing anything here?

Set your Trust Relationship to Lambda. In the IAM console -> Go to your IAM role -> click on Trust Relationship tab -> and change the trust to `lambda.amazonaws.com` — krishna_mee2004, Jan 29 '18 at 20:55
I do have the setting in the role --> Trust Relationship tab as below "Principal": { "Service": "lambda.amazonaws.com", "Federated": "cognito-identity.amazonaws.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "cognito-identity.amazonaws.com:aud": "us-east-2:e565545e-44ca-4557-baa5-56eb6e9f68ac" }, "ForAnyValue:StringLike": { "cognito-identity.amazonaws.com:amr": "unauthenticated" — Vasu Seshadri, Jan 29 '18 at 21:26

score 0 · Answer 1 · answered Jan 30 '18 at 11:31

Seems like you configured your Cognito role to be assumed by Lambda.

You have to set the following Trust Relationship for the role ALLOW_LAMBDA_EXECUTION not ALLOW_LAMBDA_EXECUTE:

{
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "Service": "lambda.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
  }
}

score 0 · Answer 2 · answered Jan 31 '18 at 22:21

After a lot of deliberation, going through multiple docs and doing some RnD, things started working.

Yes, Trust Relationship should have lambda execute and Action: sts:AssumeRoleWithWebIdentity and it should have the condition

{
"Version": "2018-1-30",
"Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com",
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "identity-pool"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "unauthenticated"
        }
      }
    }
  ]
}

Now, this will not work well with Lambdas role coz' it cannot assume the role, which I think make-sense as it has little power to do so.

Hence I have created 2 diff roles Role 1- with above trust relationship assigned to Cognito fedrated identitiy access Role 2- without changes in trust relationship assigned to Lambda role.

Now both my iOS access works with cognito identity and also AWS APIMicroServices...

Indeed took a while to crack this.

AWS Lambda - The role defined for the function cannot be assumed by Lambda

2 Answers2