AWS Lambda 功能：它不显示现有角色列表

Question

I have created a Role in IAM with AmazonEC2FullAccess based policy. This role is properly created in IAM . But the same role is not appearing to attach for lambda function.

Can someone please help. I have the admin access and with this I'm getting below error.

(AccessDenied) when calling the PutMetricAlarm operation: User: arn:aws:sts::xxx:assumed-role/lambdaEC2fullaccess/StopEc2 is not authorized to perform: iam:CreateServiceLinkedRole on resource: arn:aws:iam::xxx:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents"

Answer 1

From your screenshot, it appears that the AmazonEC2FullAccess role is for EC2 instance , not lambda. You can verify this by going into the IAM console, clicking on the AmazonEC2FullAccess and checking its trust relationship .

If the trust policy is for instance, it will look like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

However, IAM trust policy for lambda should look like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

You can edit the trust policy, and refresh your lambda console window. Or you can create new role for lambda from the beginning.