AssumeRole trusted entities to a specific lambda function

Question

I have a lambda that needs quite a lot of permissions because it automatically kills temporary resources, so I have assigned the managed policy AdministratorAccess. What I want to do is to restrict this role to only be assumed a specific lambda function. I have tried to set a condition on sts:AssumeRole, but when trying to assign this role to a lambda I get an error:

Your role is not ready, or cannot be assumed by Lambda. Please wait up to a minute and try again.

Maybe relevant; the lambda and role CF-stack is deployed with CodePipeline that uses a role CICD-Pipeline. Have anyone done this? This is what I have so far:

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: common-delete-stack-Role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com]
            Action: [sts:AssumeRole]
            Condition:
              StringEquals:
                aws:SourceArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:common-delete-stack
      ManagedPolicyArns: [arn:aws:iam::aws:policy/AdministratorAccess]

I've also tried this Condition with the same result.

StringEquals:
  lambda:FunctionArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:common-delete-stack

Might be relevant: [Is it possible to specify a pattern for an AWS role Trust Relationship](https://stackoverflow.com/a/56145538/174777) — John Rotenstein, Feb 26 '20 at 09:34
Thank you @JohnRotenstein. It seems to me that roles assuming roles and services that assumes roles work a bit differently? — crea1, Feb 26 '20 at 10:02
Trust Policies are a bit of a mystery. Keep trying various options, otherwise this is a good example of how subscribing to AWS Support could save you a lot of time. — John Rotenstein, Feb 26 '20 at 11:07
Have you tried using `ArnEquals` instead of `StringEquals` in the Condition? — Mike Patrick, Mar 01 '20 at 16:11

AssumeRole trusted entities to a specific lambda function

0 Answers0