The provided execution role does not have permissions to call DescribeNetworkInterfaces on EC2

Asked 16/12, 2016 at 5:45 Answered 18/12, 2023 at 0:39

Solved aws-lambda terraform amazon-iam roles policy

193

When I input any code in this function (e.g. console.log();) and click "Save", an error occurs:

The provided execution role does not have permissions to call DescribeNetworkInterfaces on EC2

exports.handler = (event, context, callback) => {
  callback(null, 'Hello from Lambda');
  console.log(); // here is my code   
};

I bound the function with Role: lambda_excute_execution(Policy:AmazonElasticTranscoderFullAccess).

And this function is not bound with any triggers now.

And then, I give the role AdministratorAccess Policy, I can save my source code correctly.

This role could run Functions successfully before today.

Does anyone know this error?

Hoe answered 16/12, 2016 at 5:45 Comment(0)

297

This error is common if you try to deploy a Lambda in a VPC without giving it the required network interface related permissions ec2:DescribeNetworkInterfaces, ec2:CreateNetworkInterface, and ec2:DeleteNetworkInterface (see AWS Forum).

For example, this a policy that allows to deploy a Lambda into a VPC:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeNetworkInterfaces",
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface",
        "ec2:DescribeInstances",
        "ec2:AttachNetworkInterface"
      ],
      "Resource": "*"
    }
  ]
}

Nonscheduled answered 13/2, 2019 at 11:6 Comment(5)

To add to the above comment, the same error also pops up if your LambdaExecutionRole does now have the AWSLambdaVPCAccessExecutionRole policy attached to it. – Palanquin 26/3, 2020 at 14:40

Can you be more specific than Resource: *? – Mailer 29/12, 2021 at 4:8

Only 3 actions were enough in my case: {Create,Describe,Delete}NetworkInterface – Recension 11/5, 2022 at 8:38

To clarify this answer: this error can occur if you ORIGINALLY deployed the lambda without a VPC, and NOW you're trying to add the lambda to a VPC. Apparently, in this scenario, AWS doesn't include these permissions, presumably on the principle of "least privilege". – Prevention 5/7, 2022 at 23:59

@Mailer No, not really. None of these actions support resource-level permissions. You could possibly tack on global condition keys like StringLike / user-agent / "aws-internal/*" but IMO none of them are specific enough to significantly change the situation. – Harpoon 20/9, 2023 at 18:44

110

If you are using terraform, just add:

resource "aws_iam_role_policy_attachment" "AWSLambdaVPCAccessExecutionRole" {
    role       = aws_iam_role.lambda.name
    policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
}

Turenne answered 24/9, 2020 at 10:5 Comment(1)

Can you advice how to do this with aws-sam ? – Informed 16/7, 2021 at 15:22

via Managed Policy

To grant Lambda necessary permissions to dig in to a VPC where a production RDS db resides in a private subnet.
As mentioned by @portatlas above, the AWSLambdaVPCAccessExecutionRole managed policy fits like a glove (and we all know use of IAM Managed Policies is an AWS-recommended best-practice).
This is for Lambdas with a service role already attached.

AWS CLI

1. Get Lambda Service Role

Ask Lambda API for function configuration, query the role from that, output to text for an unquoted return.

aws lambda get-function-configuration \
    --function-name <<your function name or ARN here>> \
    --query Role \
    --output text

return, take your-service-role-name to #2
```
your-service-role-name
```

2. Attach Managed Policy `AWSLambdaVPCAccessExecutionRole` to Service Role

aws iam attach-role-policy \
    --role-name your-service-role-name \
    --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole

CDK 2 TypeScript

const lambdaVPCExecutionRole:iam.Role = new iam.Role(this, `createLambdaVPCExecutionRole`, {
    roleName        : `lambdaVPCExecutionRole`,
    assumedBy       : new iam.ServicePrincipal(`lambda.amazonaws.com`),
    description     : `Lambda service role to operate within a VPC`,
    managedPolicies : [
        iam.ManagedPolicy.fromAwsManagedPolicyName(`service-role/AWSLambdaVPCAccessExecutionRole`),
    ],
});

const lambdaFunction:lambda.Function = new lambda.Function(this, `createLambdaFunction`, {
    runtime : lambda.Runtime.NODEJS_14_X,
    handler : `lambda.handler`,
    code    : lambda.AssetCode.fromAsset(`./src`),
    vpc     : vpc,
    role    : lambdaVPCExecutionRole,
});

Misanthrope answered 12/9, 2020 at 18:0 Comment(2)

"we all know use of IAM Managed Policies is an AWS-recommended best-practice" - the non-VPC managed policy for lambda execution used to grant full read-write access to all objects in S3. Don't use those policies without looking at them first. – Mailer 29/12, 2021 at 3:8

This is lovely! I got error messages using ManagedPolicy.fromAwsManagedPolicyName('AWSLambdaVPCAccessExecutionRole'). Then saw that you needed to prefix it with service-roleand that unblocked me. Thanks a lot. – Woodard 8/8, 2023 at 7:56

This is actually such a common issue.

You can resolve this by adding a custom Inline Policy to the Lambda execution role under the Permissions tab.

Just add this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeNetworkInterfaces",
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface",
        "ec2:DescribeInstances",
        "ec2:AttachNetworkInterface"
      ],
      "Resource": "*"
    }
  ]
}

There's a full tutorial with pictures here if you need more information (Terraform, CloudFormation, and AWS Console) or are confused: https://ataiva.com/the-provided-execution-role-does-not-have-permissions-to-call-createnetworkinterface-on-ec2/

Additionally, a more recent sequence of steps follows:

Under your Lambda Function, select "Configuration"
Select "Permissions"
Select the execution role:
Select "Add Permissions"
Create Inline Policy
Select "JSON"
Paste the JSON above and select Review.

Cycad answered 12/8, 2020 at 1:3 Comment(3)

"Resource": "*" isn't great. Is there something more narrow we can use? – Mailer 29/12, 2021 at 3:9

@Mailer [same answer as to your same comment above] - No, not really. None of these actions support resource-level permissions. You could possibly tack on global condition keys like StringLike / user-agent / "aws-internal/* but IMO none of them are specific enough to significantly change the situation. – Harpoon 20/9, 2023 at 18:45

works like a charm, ty! – Ops 22/9, 2023 at 14:52

It seems like this has been answered many different ways already but as of this posting, AWS has a managed policy. If you just search for the AWSLambdaVPCAccessExecutionRole you will be able to attached that, and this method worked for me.

Here is the arn:

arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole

Paranoid answered 18/7, 2021 at 23:14 Comment(0)

Just go to execution role -> Attach policy -> Search for 'AWSLambdaVPCAccessExecutionRole' and add it.

Goodish answered 18/1, 2022 at 11:29 Comment(3)

This does not provide an answer to the question. Once you have sufficient reputation you will be able to comment on any post; instead, provide answers that don't require clarification from the asker. - From Review – Aesir 21/1, 2022 at 3:41

How is this different from the other answers suggesting you attach the AWSLambdaVPCAccessExecutionRole? – Seminarian 15/2, 2022 at 20:37

This short answer is direct to the point and solved similar issue. – Elenaelenchus 21/7, 2022 at 7:55

An example for Cloudformation and AWS SAM users.

This example lambda role definition adds the managed AWSLambdaVPCAccessExecutionRole and solves the issue:

Type: "AWS::IAM::Role"
Properties:
  RoleName: "lambda-with-vpc-access"
  ManagedPolicyArns:
    - "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
  AssumeRolePolicyDocument:
    Version: "2012-10-17"
    Statement:
      - Effect: Allow
        Action:
          - sts:AssumeRole
        Principal:
          Service:
            - lambda.amazonaws.com

Trueblood answered 22/10, 2021 at 17:25 Comment(1)

this Answer is correct, Thanks. – Most 3/3 at 10:16

After a bit of experimentation, here is a solution using "least privilege". It's written in Python, for the AWS CDK. However the same could be applied to normal JSON

iam.PolicyDocument(
    statements=[
        iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            actions=["ec2:DescribeNetworkInterfaces"],
            resources=["*"],
        ),
        iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            actions=["ec2:CreateNetworkInterface"],
            resources=[
                f"arn:aws:ec2:{region}:{account_id}:subnet/{subnet_id}"
                f"arn:aws:ec2:{region}:{account_id}:security-group/{security_group_id}",
                f"arn:aws:ec2:{region}:{account_id}:network-interface/*",
            ],
        ),
        iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            actions=["ec2:DeleteNetworkInterface"],
            resources=[f"arn:aws:ec2:{region}:{account_id}:*/*"],
        ),
    ],
),

Tireless answered 16/1, 2023 at 15:44 Comment(0)

Just cause there aren't enough answers already ;) I think this is the easiest way. If you're using the web admin console, when you're creating your Lambda function in the first place, down the bottom just expand 'Advanced Settings' and check 'Enable VPC' & choose your vpc... Simple! Before doing this, my connection to my RDS proxy was timing out. After doing this (and nothing else) - works great!

Argentous answered 26/7, 2022 at 19:58 Comment(0)

Here's a quick and dirty way of resolving the error.

Open IAM on AWS console, select the role that's attached to the Lambda function and give it the EC2FullAccess permission.

This will let you update the Lambda VPC by granting EC2 control access. Be sure to remove the permission from the role, the function still runs.

Is it more or less secure than leaving some permissions attached permanently? Debatable.

Darn answered 31/12, 2020 at 19:37 Comment(0)

If you are using SAM you just need to add to the Globals in the Template, like this:

Globals:
  Function:
    VpcConfig:
      SecurityGroupIds:
        - sg-01eeb769XX2d6cc9b
      SubnetIds:
        - subnet-1a0XX614
        - subnet-c6dXXb8b
        - subnet-757XX92a
        - subnet-8afXX9ab
        - subnet-caeXX7ac
        - subnet-b09XXd81

(of course, you can put all in variables, or parameters!)

and then, to the Lambda Function, add Policies to the Properties, like this:

  BasicFunction:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
      - AWSLambdaVPCAccessExecutionRole
      - AWSLambdaBasicExecutionRole

Spiegeleisen answered 26/1, 2023 at 17:42 Comment(0)

It is definitely a strange error, but are you sure the example code you added is the one you're using in your lambda?

Because in your code, you are trying to log something in your lambda after returning control via the callback. In other words, first you told your lambda that you're done. Next, while it is busy shutting down and returning your results, you try to do some logging...

So first, I'd try this:

exports.handler = (event, context, callback) => {
    console.log('this is a test');
    // do stuff
    callback(null, 'Hello from Lambda'); // only do a callback *after* you've run all your code
};

And see if that fixes the problem.

Deceitful answered 19/12, 2016 at 14:37 Comment(1)

Thanks! It's OK now. It seems some Lambda bugs. I did nothing, but two days after It's become OK. – Hoe 20/12, 2016 at 4:26

Also check your permission boundaries on your lambda execution role, that one got me.

Peery answered 18/12, 2023 at 0:39 Comment(1)

What might be the issue there and how would you solve it? (Please edit your answer with details) – Macle 24/12, 2023 at 9:39

Hot tags

Godot Unity Godot Help Programming Godot 4.X GUI GDScript 3D 2D Physics CSharp Godot 3.X VR XR Projects C++