AWSLambda_FullAccess

Summary

Grants full access to the AWS Lambda service, AWS Lambda console features, and other related AWS services. AWS says it grants full access to Lambda actions and permissions to other AWS services used to develop and maintain Lambda resources.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AWSLambda_FullAccessCopy ARN

Default version

v7

Created

2020-11-17

Last edited

2026-02-12

Services

cloudformation, cloudwatch, ec2, iam, kms, lambda, logs, states, tag, xray

Control-plane actions (146)

By access level: 37 List, 8 Permissions management, 42 Read, 2 Tagging, 57 Write.

Data-plane actions (18)

By access level: 2 List, 3 Read, 13 Write.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: lambda (76 of 76).
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Related policies

Same service

• AmazonDynamoDBFullAccesswithDataPipeline
• AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy
• AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy
• AmazonSageMakerPipelinesIntegrations
• AmplifyBackendDeployFullAccess
• AWSApplicationAutoscalingLambdaConcurrencyPolicy
• AWSBudgetsSpendLimitMemberRolePolicy
• AWSCodeDeployRoleForCloudFormation

Same domain

• AWSCodeDeployRoleForLambda
• AWSCodeDeployRoleForLambdaLimited
• AWSContinuumCollectorServiceRolePolicy
• AWSLambda_ReadOnlyAccess
• AWSLambdaInvokeWebFunctionEndpointAccess
• AWSLambdaReplicator
• AWSLambdaRole
• AWSThinkboxDeadlineResourceTrackerAdminPolicy

Frequently asked questions

When should I attach AWSLambda_FullAccess?

The AWS Lambda Developer Guide says you can attach it to your users, groups and roles and that it grants full access to Lambda actions and related services used to develop and maintain Lambda resources. Attach it where that is the intended scope, and use a customer managed policy if you need less.

What does AWSLambda_FullAccess grant?

It allows lambda:* and a set of describe, list and get actions for CloudFormation, CloudWatch, Amazon EC2, AWS KMS, IAM, CloudWatch Logs, AWS Step Functions, tagging and AWS X-Ray, plus iam:PassRole to lambda.amazonaws.com and log reads on /aws/lambda/* log groups.

What are the security risks of AWSLambda_FullAccess?

lambda:* allows every Lambda action on all resources, and the policy lets a user pass roles to Lambda when assigning execution roles. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:ListStackResources",
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricData",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "kms:DescribeKey",
        "kms:ListAliases",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:GetRole",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:ListRoles",
        "lambda:*",
        "logs:DescribeLogGroups",
        "states:DescribeStateMachine",
        "states:ListStateMachines",
        "tag:GetResources",
        "xray:GetTraceSummaries",
        "xray:BatchGetTraces"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "lambda.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:DescribeLogStreams",
        "logs:GetLogEvents",
        "logs:FilterLogEvents",
        "logs:StartLiveTail",
        "logs:StopLiveTail"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/lambda.amazonaws.com/AWSServiceRoleForLambda",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "lambda.amazonaws.com"
        }
      }
    }
  ]
}

Version history

Current version v7, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSLambda_FullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSLambda_FullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSLambda_FullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambda_FullAccess

resource "aws_iam_role_policy_attachment" "awslambda_fullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSLambda_FullAccess"),
);

Sources

• AWSLambda_FullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, assignmentGuidance, faqs)
• AWS managed policies for AWS Lambda (AWS Lambda Developer Guide) (retrieved 2026-11-12; supports summary, useCases, bestPractices, securityConsiderations, assignmentGuidance, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AWSLambda_FullAccess
• AWS service guide
• Report a data issue