‫Okay. So let's have a look
‫at the different permissions for Lambda.
‫So if you go into the IAM consult, remember
‫that every single Lambda function must have an IAM role.
‫And so if I go into my roles
‫and just look for Lambda in here. We can see
‫we have a lot of Lambda roles right, here available to us.
‫So there is the demo Lambda role
‫the Lambda ALB, the Lambda S3
‫and we have the SQS and so on.
‫So if we look at, for example, the demo Lambda role
‫which was the first Lambda role created
‫there was a Lambda basic execution role attached to this.
‫So this gets attached pretty much
‫to every Lambda role that you create through the console.
‫And if you look at the policy of that role itself
‫we can see that it allows you to create log groups
‫and then send log events into your CloudWatch logs.
‫So the idea right here is really to have this Lambda
‫function, being able to send logs into our logs.
‫And this is why it's called basic execution role.
‫Okay. The next thing we've seen is around resource policies.
‫So whenever our lending function was invoked
‫by an asynchronous type of events
‫so the ALB Lambda S3 or eventbridge.
‫Then if we went into the configuration for permissions
‫we could find at the very bottom
‫that the resource based policy was created
‫and each resource based policy is going to be different.
‫But this one allows our elastic load balancer to
‫invoke a Lambda function.
‫Okay. If we go into Lambda S3, and again
‫go into the permissions.
‫This one allows our S3 buckets that is named demos
‫S3 event Stephane
‫to invoke another function yet again, and eventbridge
‫obviously you'll see the exact same similar thing.
‫So if we scroll down and go to resource based policy
‫we see that events
‫that amazonaws.com is allowed to invoke our function.
‫If it is this rule that we have created from before.
‫So we've seen this
‫and this is very important for you to understand
‫that in asynchronous type of invocations,
‫this is the source that is invoking the Lambda function.
‫But if you go into Lambda SQS
‫and have a look at the permissions tabs
‫this time
‫they will not be any resource based policy.
‫Well that's because the Lambda function is
‫the one invoking the SQS queue
‫pulling data messages from it, and then processing them.
‫And so therefore the execution role, our Lambda
‫function for SQS is the one that we'll need to
‫have the Lambda SQS queue execution role.
‫And this is allowing you to look at the Json.
‫This is going to allow the function to receive messages
‫delete message, get queue attributes
‫and so on, on our Lambda, on our SQS queue.
‫Okay? So this is the different kind of permissions.
‫And so we've seen how they work.
‫So either the Lambda functions gets invoked
‫or the Lambda function is, is invoking a source.
‫And so in one case it will be resource-based policy.
‫And the other one, it will be to
‫modify the IAM role attached to the Lambda function.
‫So hopefully that makes sense
‫and you will be good to go with the exam for this.
‫And I will see you in the next lecture.