aws.amazon.com/about-aws/…/aws-lambda-full-iam-resource-based-policies This security improvement lets you edit a Lambda function's resource-based policy. Before, you had to call the

lambda:AddPermission

API method to add single statements, and all those did was

Allow

specific principals to

lambda:InvokeFunction

. For an analogy, compare the expressiveness of security group rules (allow only) and Network Access Control List rules (allow or deny). CloudFormation:

AWS::Lambda::Permission

→

AWS::Lambda::ResourcePolicy

Terraform:

aws_lambda_permission

→

aws_lambda_policy

(proposed in

terraform-provider-aws

issue

49691

; not implemented as of

v6.62

; you could use

terraform-provider-awscc

for now) Benefits: • You can use IAM condition keys to intelligently target principals that can invoke a Lambda function. • You can make permission to invoke a Lambda function exclusive (for example, exclusive to the event source mapping from one particular SQS queue) by adding a

Deny

statement to complement an

Allow

statement in the same resource policy or in an identity-based (IAM user or role) policy. Before, you would have needed a Service Control Policy to prevent unintended IAM users and roles from invoking particular Lambda functions. Exclusive permission to invoke a Lambda function is now practical, but I need to check whether old restrictions on role trust (assume role) policies for the Lambda service have been relaxed so it's practical to make an IAM role exclusive to a Lambda function.