Skip to main content

IAM Policy Lambda Execute

📦 Overview​

This Terraform module provisions an IAM policy for AWS Lambda execution, enabling Lambda functions to run securely with logging and optional service access.

✅ Key Features​

  • Grants execution permissions for AWS Lambda
  • Enables CloudWatch logging
  • Built with least-privilege access design
  • Includes tagging for clarity and governance
  • Supports additional permissions for common Lambda integrations

💼 Use Cases​

  • Attach to Lambda IAM roles to enable secure function execution
  • Use as a baseline policy for all serverless apps
  • Combine with Lambda layers or VPC access configurations
  • Extend with additional managed policies for specific workloads

📥 Input Variables​

NameTypeDescription
regionstringAWS region for deployment
policy_namestringName of the IAM policy
environmentstringEnvironment label for tagging (e.g., dev, prod)

📤 Outputs​

NameDescription
policy_arnARN of the created IAM policy

🚀 Deployment Readiness​

  • ✅ Compatible with Terraform 1.0+
  • ✅ Requires AWS Provider 5.x+
  • 🔐 IAM permissions required: iam:CreatePolicy, iam:DeletePolicy

🛠️ Example Usage​

module "iam_policy_lambda_execute_deployment" {
  source = "git::ssh://git@github.com/archiphire/aws-level-1-modules.git//identity/iam-policy-lambda-execute?ref=v1.0.0"

  region       = "us-east-1"
  policy_name  = "lambda-execution-policy"
  environment  = "dev"
}
terraform init
terraform plan
terraform apply

or

tofu init
tofu plan
tofu apply

🧹 Cleanup​

Terraform Destroy:

terraform destroy

or

tofu destroy

Manual Deletion (for Production):

aws iam delete-policy --policy-arn <policy_arn>

Use aws iam list-policies to find the policy ARN if needed.

🛡️ Notes​

This is a Level 1 identity module designed to pair with Lambda IAM roles.
Avoid overly broad permissions—scope access to just what the Lambda function needs.
Best used alongside logging, VPC access, or other runtime policies in larger serverless deployments.

🔒 Deployment Package Notice​

This module is part of the Level 1 AWS License Tier.
To access the full deployment package and source code, subscribe to Archiphire.