Ravi Sir's Cards › AWS
IAM for the state machine
This revision card explains IAM for the state machine. It starts from the need that execution fails with AccessDenied when the role cannot invoke Lambda or write logs. The state machine role needs lambda — InvokeFunction on target functions and permission for any service integration you call. The how-to section covers how to create a role trusted by states.amazonaws.com; attach least-privilege policy for each Task resource ARN. An example on the card is after fixing the role, a new execution reaches the Lambda Task instead of failing at schedule time.
Read card text
What this card says
Why do we need it?
Execution fails with AccessDenied when the role cannot invoke Lambda or write logs.
What is it?
The state machine role needs lambda:InvokeFunction on target functions and permission for any service integration you call.
lambda:InvokeFunction
How to do it
Create a role trusted by states.amazonaws.com; attach least-privilege policy for each Task resource ARN.
Example
After fixing the role, a new execution reaches the Lambda Task instead of failing at schedule time.