Execution failed due to configuration error: Invalid permissions on Lambda function

Question

I am building a serverless application using AWS Lambda and API Gateway via Visual Studio. I am working in C#, and using the serverless application model (SAM) in order to deploy my API. I build the code in Visual Studio, then deploy via publish to Lambda. This is working, except every time I do a new build, and try to execute an API call, I get this error:

Execution failed due to configuration error: Invalid permissions on Lambda function

Doing some research, I found this fix mentioned elsewhere (to be done via the AWS Console):

Fix: went to API Gateway > API name > Resources > Resource name > Method > Integration Request > Lambda Function and reselected my existing function, before "saving" it with the little checkmark.

Now this works for me, but it breaks the automation of using the serverless.template (JSON) to build out my API. Does anyone know how to fix this within the serverless.template file? So that I don't need to take action in the console to resolve? Here's a sample of one of my methods from the serverless.template file

{
  "AWSTemplateFormatVersion" : "2010-09-09",
  "Transform" : "AWS::Serverless-2016-10-31",
  "Description" : "An AWS Serverless Application.",

  "Resources" : {

    "Get" : {
      "Type" : "AWS::Serverless::Function",
      "Properties": {
        "VpcConfig":{
          "SecurityGroupIds" : ["sg-111a1476"],
          "SubnetIds" : [ "subnet-3029a769","subnet-5ec0b928"]
        },
        "Handler": "AWSServerlessInSiteDataGw::AWSServerlessInSiteDataGw.Functions::Get",
        "Runtime": "dotnetcore2.0",
        "CodeUri": "",
        "MemorySize": 256,
        "Timeout": 30,
        "Role": null,
        "Policies": [ "AWSLambdaBasicExecutionRole","AWSLambdaVPCAccessExecutionRole","AmazonSSMFullAccess"],
        "Events": {
          "PutResource": {
            "Type": "Api",
            "Properties": {
              "Path": "/",
              "Method": "GET"
            }
          }
        }
      }
    },

Solution 1

You may have an issue in permission config, that's why API couldn't call your lambda. try to explicitly add to template.yaml file invoke permission to your lambda from apigateway as a principal here's a sample below:

  ConfigLambdaPermission:
    Type: "AWS::Lambda::Permission"
    DependsOn:
    - MyApiName
    - MyLambdaFunctionName
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref MyLambdaFunctionName
      Principal: apigateway.amazonaws.com

Here's the issue that was reported in SAM github repo for complete reference and here is an example of hello SAM project

If you would like to add permission by AWS CLI for testing things out, you may want to use aws lambda add-permission. please visit official documentation website for more details.

Solution 2

I had a similar issue - I deleted then re-installed a lambda function. My API Gateway was still pointing at the old one, so I had to go into the API Gateway and change my Resource Methods to alter the Integration Request setting to point to the new one (it may look like it's pointing to the correct one but wasn't in my case)

Solution 3

I was having the same issue but I was deploying through Terraform. After a suggestion from another user, I reselected my Lambda function in the Integration part of the API Gateway, and then checked what changed in my Lambda permissions. Turns out I needed to add a "*" where I was putting the stage name in the source_arn section of the API Gateway trigger in my Lambda resource. Not sure how SAM compares to Terraform but perhaps you can change the stage name or just try this troubleshooting technique that I tried.

My SO posting: AWS API Gateway and Lambda function deployed through terraform -- Execution failed due to configuration error: Invalid permissions on Lambda function

Solution 4

Same error, and the solution was simple: clearing and applying the "Lambda Function" mapping again in the integration setting of the API Gateway.

My mapping looks like this: MyFunction-894AR653OJX:test where "test" is the alias to point to the right version of my lambda

The problem was caused by removing the ALIAS "test" on the lambda, and recreating it on another version (after publishing). It seems that the API gateway internally still links to the `old' ALIAS instance. You would expect that the match is purely done on name...

Bonus: so, via the AWS console you cannot move that ALIAS, but you can do this via the AWS CLI, using the following command:

aws lambda --profile <YOUR_PROFILE> update-alias --function-name <FUNCTION_NAME> --name <ALIAS_NAME> --function-version <VERSION_NUMBER>

Solution 5

Facing the same issue, I figured out the problem is : API Gateway is not able to invoke the Lambda function as I couldn't see any CloudWatch logs for the lambda Function.

So firstly I went through API Gateway console and under the Integration Request - gave the full ARN for the Lambda Function. and it is started working.

Secondly, through the CloudFormation

x-amazon-apigateway-integration:
        credentials:
          Fn::Sub: "${ApiGatewayLambdaRole.Arn}"
        type: "aws"
        uri:
          Fn::Sub: "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${lambda_function.Arn}/invocations"

View more solutions

Comments

[Df.fpm]

I had the same case. Thank you for this note!

[atom88]

I had a similar terraform deployment error to and was able to fix it by adding in the additional permission in my terraform code. I found I had to go into the lambda function and look at the effective policy to see the difference. I discovered that with the policy has the "statement ID" it's one that was done via terraform, and when it has a GUID looking ID it's one done via the console. This helped me figure out the correct one to add.

[atom88]

It would seem this is a bug based on this post: github.com/terraform-providers/terraform-provider-aws/issues‌​/…

[atom88]

It would seem this is a bug based on this post: github.com/terraform-providers/terraform-provider-aws/issues‌​/…

[atom88]

Thank you sooo much for this post. I had a similar problem and was able to resolve it with the information provided in this post!

[Matteo]

Unfortunately that is not a valid solution as this represent an underlying bug with AWS. Also if you have a Cloudformation template you cannot modify resources into the console.

[rainabba]

I was missing credentials and your answer helped me see that. Cheers!