Skip to main content
This section shows how to deploy and configure the IAM execution role that your Lambda function will assume. The role lets the Lambda service run your code securely and gives the function the permissions it needs (for example, to write logs or access other AWS services). Follow the steps below to create the trust policy and verify the role.

​
Create the IAM execution role

Create an IAM role and provide an assume role (trust) policy that allows the Lambda service to assume the role:
This JSON trust policy grants the Lambda service permission to assume the role. Key fields in the trust policy:
  • Version — The policy language version.
  • Statement.Effect — Allow permits the action.
  • Statement.Principal — The AWS service or principal allowed to assume the role (lambda.amazonaws.com here).
  • Statement.Action — sts:AssumeRole is the action that allows the principal to assume the role.
The assume role policy (also called the trust policy) establishes who can assume the role. The role still requires an identity permissions policy to specify what the Lambda function can do after assuming the role.
Grant only the permissions your Lambda function needs. Start with the managed policy service-role/AWSLambdaBasicExecutionRole for CloudWatch Logs, then narrow permissions with a custom inline or managed policy to follow the principle of least privilege.

​
Provide runtime permissions

A typical Lambda execution role needs permission to write logs to CloudWatch. You can grant this using the AWS managed policy AWSLambdaBasicExecutionRole or by creating a minimal custom policy that only allows the required actions. Example: attach the AWS managed logging policy using the AWS CLI: aws iam attach-role-policy --role-name name-picker-execution-role --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Alternatively, add a custom inline policy that grants only the specific permissions your function needs (for example, specific S3 or DynamoDB actions). Using managed policies is a convenient starting point; refine permissions later.

​
Verify the role and trust relationship

You can inspect the role and its trust relationship in the AWS Console:
  1. Open the IAM service.
  2. Select “Roles”.
  3. Choose the role (for example, name-picker-execution-role).
  4. View the Trust relationships tab to confirm the assume role policy.
  5. View the Permissions tab to verify attached policies (for logging and any resource access).
To summarize:
  • Every Lambda function assumes an IAM execution role that contains two parts:
    • The trust policy (assume role policy) — who can assume the role (here, the Lambda service).
    • The permissions policy — what the function is allowed to do (CloudWatch logs, S3, DynamoDB, etc.).
  • Start with service-role/AWSLambdaBasicExecutionRole to enable logging, then apply least-privilege custom policies for additional resource access.
That concludes this section on deploying and configuring the IAM role for your Lambda function.

Watch Video