AWS IAM policy generator

1. Which thing needs the role?

The compute that makes the calls. It assumes the role; everything else is a resource the role points at.

Changing this opens that principal’s own page.

2. What does it call?

Only connections the knowledge base records IAM requirements for. Tick what your Lambda actually talks to.

• DynamoDBLambda reads/writes DynamoDB items via the AWS SDK (typical serverless API backend pattern)
• EventBridgeLambda publishes a custom event to an event bus with PutEvents, so other services can react through EventBridge rules without the function calling them directly — the producer stays decoupled from its consumers
• S3Lambda reads/writes S3 objects via the AWS SDK (e.g. generate a thumbnail and write it back to a bucket)
• Secrets ManagerThe function reads a secret (e.g. the database credentials for its RDS/RDS Proxy connection, or a third-party API key) from Secrets Manager at runtime via the AWS SDK instead of storing it in an environment variable
• SESLambda sends transactional email through SES — e.g. a worker triggered by an SQS queue sends the confirmation email for a CRUD write
• SNSLambda publishes a message to an SNS topic to fan an event out to multiple subscribers (e.g. notify several downstream systems after a write)
• SQSLambda sends messages to an SQS queue to decouple work — e.g. an API handler enqueues an email/notification job instead of doing it inline in the request

3. Fill in your account (optional)

Leave these blank and the ARNs keep visible placeholders, so a half-finished policy fails instead of quietly granting more than you meant.

Nothing selected yet, so the role below can be assumed but grants nothing. Tick a service above.

{
  "Version": "2012-10-17",
  "Statement": []
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "LambdaAssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Before you apply this

• These are the actions this integration typically needs — not a least-privilege proof. After you deploy, narrow the policy with IAM Access Analyzer, which generates one from the calls the principal actually made.
• No permissions were generated. The role below can be assumed but grants nothing — pick at least one service this principal calls.

Worth knowing about a Lambda execution role

• Lambda assumes this role for you — the function's SDK picks up temporary credentials from the environment, so never put access keys in environment variables or the deployment package.