AWS has expanded Lambda’s security model, allowing functions to use full IAM resource‑based policies for granular access control across multi‑account environments.

AWS Lambda now supports full IAM resource‑based policies, giving developers granular control over function permissions across multi‑account environments.

What the new capability means

Lambda functions can now attach IAM policies directly to the function resource, allowing precise permission definitions without relying solely on execution roles. This change simplifies cross‑account access and aligns Lambda with other AWS services that already support resource‑based policies.

Key benefits

  • Fine‑grained access control for individual functions
  • Simplified cross‑account invocation and data sharing
  • Reduced need for complex role‑assumption chains
  • Improved security posture with least‑privilege defaults

How to implement

To use resource‑based policies, add a Policy element to the Lambda function configuration via the AWS Management Console, AWS CLI, or SDKs. The policy follows standard IAM JSON syntax, specifying Action, Principal, and Condition elements as needed.

Existing functions can be updated in place, and new functions can be created with policies attached from the start. AWS recommends testing policies in a staging environment before applying them to production workloads.

Best practices

Use least‑privilege principles by granting only the actions required for each function. Combine resource‑based policies with AWS Lambda layers and environment variables to maintain a clean security model. Regularly review and audit policies using AWS IAM Access Analyzer.

“Resource‑based policies bring Lambda in line with services like S3 and SNS, making cross‑account architectures much more straightforward.”

For detailed guidance, see the official AWS announcement.

AWS announcement of full IAM resource‑based policies for Lambda