1 00:00:00,450 --> 00:00:08,460 In this video, we are going to learn Ada Lovelace, Lambda Permissions, which is the execution role 2 00:00:08,460 --> 00:00:10,710 and the resource based policy. 3 00:00:11,550 --> 00:00:14,460 Ada Lovelace has a service that handle permissions. 4 00:00:14,460 --> 00:00:18,290 Which name is ADA Identity and Access Management? 5 00:00:18,300 --> 00:00:24,460 We can call I am so we can use ADA Lovelace Identity and Access Management. 6 00:00:24,480 --> 00:00:27,960 I am in order to manage access to Lambda functions. 7 00:00:28,560 --> 00:00:36,720 We can manage permissions in a permission policy that we can apply to users, groups and roles in order 8 00:00:36,720 --> 00:00:40,200 to execute lambda functions with policy definitions. 9 00:00:40,290 --> 00:00:45,600 So basically, Lambda function also has a policy which name is execution role. 10 00:00:47,300 --> 00:00:54,650 Lambda execution grants permissions to access the ADA services and resources by default. 11 00:00:54,680 --> 00:00:59,160 LAMB The function needs to access to Amazon Cloud watch logs for log streaming. 12 00:00:59,180 --> 00:01:05,450 So that means when we create any lambda function by default, it comes with the execution role which 13 00:01:05,450 --> 00:01:07,850 including Amazon cloud, which logs. 14 00:01:08,610 --> 00:01:16,500 So if Lambda Function will access services with the ADA SDK, we should grant it permissions to call 15 00:01:16,500 --> 00:01:19,110 Ada Lovelace resources in the execution mode. 16 00:01:19,260 --> 00:01:25,170 For example, if our Lambda function access to dynamic DB to perform CRUD operations, we should give 17 00:01:25,170 --> 00:01:30,270 required permissions in the execution role of the lambda function as the same way. 18 00:01:30,540 --> 00:01:36,320 Lambda also uses the execution role to get permissions to read from event sources. 19 00:01:36,330 --> 00:01:42,120 When you use an event source mapping to trigger our function, for example, if our lambda function 20 00:01:42,120 --> 00:01:48,270 read Q records from the Amazon case, we should give required permissions in the execution role of the 21 00:01:48,270 --> 00:01:49,200 lambda function. 22 00:01:50,700 --> 00:01:56,790 There is also another type of permission of lambda function, which is the resource based policy. 23 00:01:57,760 --> 00:02:04,020 We will use the source based policy to give other aid sources permission to use our lambda function. 24 00:02:04,030 --> 00:02:10,550 For example, when an individual service like Amazon S3 calls invoke our lambda function. 25 00:02:10,570 --> 00:02:13,510 The resource based policy gives it access. 26 00:02:14,110 --> 00:02:18,640 So now let me see one by one these two role and permissions. 27 00:02:18,910 --> 00:02:22,360 I would like to start with the lambda execution world. 28 00:02:23,350 --> 00:02:30,130 If you summarize the permissions on a lambda, we will use two type of permissions when working with 29 00:02:30,130 --> 00:02:31,130 a lambda. 30 00:02:31,180 --> 00:02:36,160 The first one is the lambda execution role, and the second one is the resource based policy. 31 00:02:36,580 --> 00:02:39,430 Now, let's elaborate these permissions one by one. 32 00:02:40,390 --> 00:02:42,250 A the based lambda execution role. 33 00:02:42,280 --> 00:02:49,210 Lambda execution role is an IAM role that lambda has permissions to assume when invoking lambda function. 34 00:02:50,530 --> 00:02:55,030 We need to select or create an execution role when creating a new lambda function. 35 00:02:55,060 --> 00:03:00,940 And after that we can also modify the policies associated with the IAM role using the IAM. 36 00:03:01,390 --> 00:03:06,710 We set that the default lambda execution role includes the permission to write to Amazon Cloud Watch 37 00:03:06,730 --> 00:03:07,300 logs. 38 00:03:08,320 --> 00:03:15,310 So when we modify this execution role, if you have additional targets from your lambda function, for 39 00:03:15,310 --> 00:03:22,810 example, performing CRUD operations on the DB table or sending notification to Amazon SANS or try to 40 00:03:22,810 --> 00:03:30,130 access any other resources from Lambda function, then lambda functions execution will required permissions 41 00:03:30,130 --> 00:03:32,620 to interact with those services. 42 00:03:32,950 --> 00:03:35,950 For example, write database or send SNS topic. 43 00:03:35,980 --> 00:03:40,030 These kind of roles need to assign the lambda execution role. 44 00:03:40,060 --> 00:03:45,130 That means we should grant these services into lambda execution role. 45 00:03:45,460 --> 00:03:51,220 If Lambda function needs to retrieve messages from the queue or streams with the event source way, 46 00:03:51,250 --> 00:03:58,060 we should also grant execution rule to pull message from the queue because in streaming event source 47 00:03:58,060 --> 00:04:04,360 mapping scenario, lambda actively pulls the queue to get batch of records and that means it needs to 48 00:04:04,360 --> 00:04:05,920 permission into execution. 49 00:04:05,920 --> 00:04:14,440 All the best practice, the use execution roll or any granting permission is grant least privileged 50 00:04:14,470 --> 00:04:16,690 access to your lambda execution role. 51 00:04:17,670 --> 00:04:23,430 When you first create an IAM role for your lambda function during the development phase, you might 52 00:04:23,430 --> 00:04:29,250 sometimes grant permissions beyond what is required before publishing your function in the production 53 00:04:29,250 --> 00:04:30,000 environment. 54 00:04:30,030 --> 00:04:35,010 Best practice is to adjust the policy to include only required permissions. 55 00:04:35,860 --> 00:04:38,500 A double major policy for Lambda features. 56 00:04:38,500 --> 00:04:42,870 ADA has also managed policies for Lambda execution rules. 57 00:04:42,880 --> 00:04:48,130 You can see on the image slide, which is including the Lambda execution rules. 58 00:04:48,160 --> 00:04:50,710 There is some execution rule in here. 59 00:04:50,740 --> 00:04:55,180 You can see that ADA is Lambda Basic execution rule in here. 60 00:04:55,540 --> 00:04:59,260 It is basically Lambda started tracking change to this policy. 61 00:04:59,290 --> 00:05:05,920 Lambda execution world grants permission to upload logs to cloud watch and we can also this kind of 62 00:05:05,920 --> 00:05:08,260 manage policies like for dynamic DB. 63 00:05:08,290 --> 00:05:11,470 Here you can find a lambda dynamic DB execution role. 64 00:05:11,830 --> 00:05:17,530 This is grants permission to read records from Amazon, dynamic TV streams and right to cloud watch. 65 00:05:17,650 --> 00:05:23,740 And also you can see this Amazon idealism, the exquisite execution role. 66 00:05:23,770 --> 00:05:29,670 This is basically grants permission to read a message from Amazon as case queue and right to cloud watch 67 00:05:29,680 --> 00:05:30,220 logs. 68 00:05:30,220 --> 00:05:38,680 And there is also lots of managed policies in a place environment that you can assign this execution 69 00:05:38,680 --> 00:05:40,660 role when you create your lambda function. 70 00:05:40,690 --> 00:05:47,550 You can check this address and see what else can be happening here. 71 00:05:47,560 --> 00:05:54,550 If you come this address and if you scroll down, you can see that these are the manage policies provided 72 00:05:54,550 --> 00:06:02,200 from the ADA is that we can assign when we create our lambda functions to see that this is Dynamo DB, 73 00:06:02,200 --> 00:06:05,890 Kinesis, s case S3 and so on. 74 00:06:05,920 --> 00:06:10,840 You can set these managed policies according to your use cases. 75 00:06:11,200 --> 00:06:11,880 Okay. 76 00:06:11,950 --> 00:06:19,630 If you come back to our slide, we can continue the another permission type, which is the Lambda resource 77 00:06:19,630 --> 00:06:20,800 based policy. 78 00:06:22,030 --> 00:06:27,760 So basically we have another permission type for Lambda function, which is the resource based policy. 79 00:06:27,760 --> 00:06:34,840 We used resource based policy one in a service invoke our lambda function, synchronous or asynchronous 80 00:06:34,840 --> 00:06:37,180 way resource based policy. 81 00:06:37,180 --> 00:06:44,620 Let us to grant usage permission to other accounts or organization on per users basis. 82 00:06:45,490 --> 00:06:52,030 You also use a resource based policy to allow any service to invoke or function on your behalf. 83 00:06:53,080 --> 00:06:58,660 For example, if you create an API gateway that targets to Lambda function, we should add the resource 84 00:06:58,660 --> 00:07:02,350 based policy permission to invoke Lambda function from API Gateway. 85 00:07:02,530 --> 00:07:07,960 This is a synchronous invocation example that API Gateway invokes to lambda function synchronously. 86 00:07:07,990 --> 00:07:15,760 We should add resource based policy if we give an example for asynchronous case, Amazon S3 uploads 87 00:07:15,760 --> 00:07:18,320 even trigger to lambda function asynchronously. 88 00:07:18,340 --> 00:07:23,050 So we should also add resource based policy into our lambda function grants. 89 00:07:23,080 --> 00:07:24,700 S3 invocations. 90 00:07:25,340 --> 00:07:29,990 And I would like to show you an example, resource based policy documentation. 91 00:07:30,380 --> 00:07:35,810 If you come here in this address, you can see that the example, the resource based policy. 92 00:07:35,840 --> 00:07:44,470 In this example, you can see that we are giving the lambda invoke function action from the Amazon S3 93 00:07:44,480 --> 00:07:50,600 so Amazon S3 can be trigger lambda function asynchronously when uploading an object into the bucket. 94 00:07:50,600 --> 00:07:58,310 And it is requiring this kind of resource based policy in order to invoke our lambda function correctly. 95 00:07:58,340 --> 00:08:03,740 Otherwise, this will be get an error, which is an unauthorized error. 96 00:08:04,460 --> 00:08:08,080 But we can set the resource based policy from the management console. 97 00:08:08,090 --> 00:08:12,290 We can choose the function, choose the configurations and choose the permissions permissions. 98 00:08:12,290 --> 00:08:13,700 Under the permission types. 99 00:08:13,700 --> 00:08:20,450 We can set the resource based policy, and you can see the example statement that allows the Amazon 100 00:08:20,450 --> 00:08:23,120 S3 to invoke our Lambda function. 101 00:08:23,120 --> 00:08:27,680 Which name is the my function and our bucket name is in here also. 102 00:08:27,950 --> 00:08:35,540 So as you can see that we have understood to a Lambda Permissions, the first one is the execution role 103 00:08:35,540 --> 00:08:37,970 and the second one is the resource based policy. 104 00:08:38,000 --> 00:08:39,710 You can see the image in here. 105 00:08:39,710 --> 00:08:41,510 Here is the lambda function. 106 00:08:41,570 --> 00:08:48,560 If we want to interact with some resources, we need to include the permissions under the lambda execution 107 00:08:48,560 --> 00:08:54,920 role to interact performing the code operation with Dynamo DB or put put logs in the cloud watch logs 108 00:08:54,920 --> 00:08:59,060 or put any Q system case and so on. 109 00:08:59,060 --> 00:09:04,640 This is the execution role, but when it comes to some services to the lambda function, synchronous 110 00:09:04,640 --> 00:09:07,970 or asynchronous way, we should set the resource based policy. 111 00:09:07,970 --> 00:09:13,850 For example, if we expose an API to invoke the Lambda function from the API gateway, we should add 112 00:09:13,850 --> 00:09:17,060 the resource based policy to invoke synchronous lambda function. 113 00:09:17,060 --> 00:09:22,280 Or we can set the Amazon S3 or SAS asynchronous stream of our lambda function. 114 00:09:22,280 --> 00:09:24,920 It is also required resource based policy. 115 00:09:24,950 --> 00:09:30,470 This is a very good illustration to understand the permissions for the lambda function, for the execution 116 00:09:30,680 --> 00:09:32,600 role and the resource based policy. 117 00:09:32,630 --> 00:09:36,950 Now we can continue to our testing lambda function. 118 00:09:36,950 --> 00:09:38,870 We're using the management console.