hashicorp / terraform-provider-aws

The AWS Provider enables Terraform to manage AWS resources.
https://registry.terraform.io/providers/hashicorp/aws
Mozilla Public License 2.0
9.64k stars 9.02k forks source link

[Bug]: Cannot create new Lambda functions with aws_lambda_function without iam:ListRolePolicies action #38305

Open OmpahDev opened 2 weeks ago

OmpahDev commented 2 weeks ago

Terraform Core Version

1.4.0

AWS Provider Version

5.57.0

Affected Resource(s)

aws_lambda_function

Expected Behavior

Lambda function should have been created. I can create Lambda functions in the AWS GUI using the exact same user as the one I'm currently authenticated to the AWS CLI with.. but with this exact same user, TF fails. Creating lambda functions in the portal doesn't require iam:ListRolePolicies permission so why does creating it with TF require it?

Actual Behavior

│ Error: reading inline policies for IAM role lambda_execution_role, error: operation error IAM: ListRolePolicies, https response error StatusCode: 403, RequestID: ---, api error AccessDenied: User: --- is not authorized to perform: iam:ListRolePolicies on resource: role lambda_execution_role because no identity-based policy allows the iam:ListRolePolicies action

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

data "aws_iam_role" "existing_lambda_role" {
  name = "---"
}

resource "aws_lambda_function" "test-demo" {
  function_name = "sshorkey-test-demo2"
  handler       = "lambda_function.lambda_handler"
  runtime       = "python3.12"

  role          = data.aws_iam_role.existing_lambda_role.arn
  filename  = "lambda_function.zip"

  source_code_hash = filebase64sha256("lambda_function.zip")

  environment {
    variables = {
      API_KEY = "--"
    }
  }
}

Steps to Reproduce

Deploy TF

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

github-actions[bot] commented 2 weeks ago

Community Note

Voting for Prioritization

Volunteering to Work on This Issue