When should I attach AWSLambda_ReadOnlyAccess?

The AWS Lambda Developer Guide says you can attach it to your users, groups and roles and that it grants read-only access to Lambda resources and related services. Attach it where viewing Lambda is the intended scope.

What are the security risks of AWSLambda_ReadOnlyAccess?

It has no Lambda create, update or delete action, but it can read Lambda log data and IAM role and policy details. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to.

AWSLambda_ReadOnlyAccess

AnalystAWS managedActiveReviewedShow on map Compare

Summary

Grants read-only access to the AWS Lambda service, AWS Lambda console features, and other related AWS services. AWS says it grants read-only access to Lambda resources and to other services used to develop and maintain Lambda resources.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN: arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess
Default version: v5
Created: 2020-11-17
Last edited: 2026-02-12
Services: cloudformation, cloudwatch, ec2, iam, kms, lambda, logs, states, tag, xray

Control-plane actions (85)

By access level: 39 List, 46 Read.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudFormation	3 of 104	3 List; 0 restricted, 0 conditional	cloudformation:DescribeStacks, cloudformation:ListStackResources, cloudformation:ListStacks
EC2	3 of 834	3 List; 0 restricted, 0 conditional	ec2:DescribeSecurityGroups, ec2:DescribeSubnets, ec2:DescribeVpcs
IAM	7 of 190	3 List, 4 Read; 0 restricted, 0 conditional	iam:GetPolicy, iam:GetPolicyVersion, iam:GetRole, iam:GetRolePolicy, iam:ListAttachedRolePolicies, iam:ListRolePolicies, iam:ListRoles
KMS	1 of 58	1 List; 0 restricted, 0 conditional	kms:ListAliases
Lambda	56 of 121	25 List, 31 Read; 0 restricted, 0 conditional	lambda:Get, lambda:List
CloudWatch Logs	12 of 133	3 List, 9 Read; 11 restricted, 0 conditional	logs:DescribeLogGroups, logs:DescribeLogStreams, logs:DescribeQueries, logs:FilterLogEvents, logs:GetLogEvents, logs:GetLogGroupFields, logs:GetLogRecord, logs:GetQueryResults, logs:StartLiveTail, logs:StartQuery, logs:StopLiveTail, logs:StopQuery
Step Functions	2 of 37	1 List, 1 Read; 0 restricted, 0 conditional	states:DescribeStateMachine, states:ListStateMachines
Resource Group Tagging	1 of 9	1 Read; 0 restricted, 0 conditional	tag:GetResources

CloudFormation: 3 actions

cloudformation:DescribeStacks (List)
cloudformation:ListStackResources (List)
cloudformation:ListStacks (List)

EC2: 3 actions

ec2:DescribeSecurityGroups (List)
ec2:DescribeSubnets (List)
ec2:DescribeVpcs (List)

IAM: 7 actions

iam:GetPolicy (Read)
iam:GetPolicyVersion (Read)
iam:GetRole (Read)
iam:GetRolePolicy (Read)
iam:ListAttachedRolePolicies (List)
iam:ListRolePolicies (List)
iam:ListRoles (List)

KMS: 1 actions

kms:ListAliases (List)

Lambda: 56 actions

lambda:GetAccountSettings (Read)
lambda:GetAlias (Read)
lambda:GetCapacityProvider (Read)
lambda:GetCodeSigningConfig (Read)
lambda:GetDurableExecution (Read)
lambda:GetDurableExecutionHistory (Read)
lambda:GetEventSourceMapping (Read)
lambda:GetFunction (Read)
lambda:GetFunctionCodeSigningConfig (Read)
lambda:GetFunctionConcurrency (Read)
lambda:GetFunctionConfiguration (Read)
lambda:GetFunctionEventInvokeConfig (Read)
lambda:GetFunctionRecursionConfig (Read)
lambda:GetFunctionScalingConfig (Read)
lambda:GetFunctionUrlConfig (Read)
lambda:GetLayerVersion (Read)
lambda:GetLayerVersionPolicy (Read)
lambda:GetMicrovm (Read)
lambda:GetMicrovmImage (Read)
lambda:GetMicrovmImageBuild (Read)
lambda:GetMicrovmImageVersion (Read)
lambda:GetNetworkConnector (Read)
lambda:GetPolicy (Read)
lambda:GetProvisionedConcurrencyConfig (Read)
lambda:GetResourcePolicy (Read)
lambda:GetRuntimeManagementConfig (Read)
lambda:GetWebAccountSettings (Read)
lambda:GetWebFunction (Read)
lambda:GetWebFunctionEndpoint (Read)
lambda:GetWebFunctionRevision (Read)
lambda:ListAliases (List)
lambda:ListCapacityProviders (List)
lambda:ListCodeSigningConfigs (List)
lambda:ListDurableExecutionsByFunction (List)
lambda:ListEventSourceMappings (List)
lambda:ListFunctionEventInvokeConfigs (List)
lambda:ListFunctionUrlConfigs (List)
lambda:ListFunctionVersionsByCapacityProvider (List)
lambda:ListFunctions (List)
lambda:ListFunctionsByCodeSigningConfig (List)
lambda:ListLayerVersions (List)
lambda:ListLayers (List)
lambda:ListManagedMicrovmImageVersions (List)
lambda:ListManagedMicrovmImages (List)
lambda:ListMicrovmImageBuilds (List)
lambda:ListMicrovmImageVersions (List)
lambda:ListMicrovmImages (List)
lambda:ListMicrovms (List)
lambda:ListNetworkConnectorVersions (List)
lambda:ListNetworkConnectors (List)
lambda:ListProvisionedConcurrencyConfigs (List)
lambda:ListTags (Read)
lambda:ListVersionsByFunction (List)
lambda:ListWebFunctionEndpoints (List)
lambda:ListWebFunctionRevisions (List)
lambda:ListWebFunctions (List)

CloudWatch Logs: 12 actions

logs:DescribeLogGroups (List)
logs:DescribeLogStreams (List)
logs:DescribeQueries (List)
logs:FilterLogEvents (Read)
logs:GetLogEvents (Read)
logs:GetLogGroupFields (Read)
logs:GetLogRecord (Read)
logs:GetQueryResults (Read)
logs:StartLiveTail (Read)
logs:StartQuery (Read)
logs:StopLiveTail (Read)
logs:StopQuery (Read)

Step Functions: 2 actions

states:DescribeStateMachine (Read)
states:ListStateMachines (List)

Resource Group Tagging: 1 actions

tag:GetResources (Read)

Data-plane actions (5)

By access level: 2 List, 3 Read.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	2 of 5	1 List, 1 Read; 0 restricted, 0 conditional	cloudwatch:GetMetricData, cloudwatch:ListMetrics
Lambda	1 of 14	1 Read; 0 restricted, 0 conditional	lambda:Get*
X-Ray	2 of 12	1 List, 1 Read; 0 restricted, 0 conditional	xray:BatchGetTraces, xray:GetTraceSummaries

CloudWatch: 2 actions

cloudwatch:GetMetricData (Read)
cloudwatch:ListMetrics (List)

Lambda: 1 actions

lambda:GetDurableExecutionState (Read)

X-Ray: 2 actions

xray:BatchGetTraces (List)
xray:GetTraceSummaries (Read)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants read access plus query or analysis actions that expose data.

Guidance

Practical scope

The first statement allows lambda:Get* and lambda:List* plus describe, list and get actions for CloudFormation, CloudWatch, Amazon EC2, AWS KMS, IAM, CloudWatch Logs, AWS Step Functions, tagging and AWS X-Ray, on Resource "*". A second statement allows log actions such as logs:GetLogEvents, logs:FilterLogEvents, logs:StartQuery and logs:StartLiveTail only on log groups matching arn:aws:logs:*:*:log-group:/aws/lambda/*. The policy has no lambda create, update or delete action.

Use cases

View Lambda resources and the related CloudFormation, CloudWatch, Amazon EC2, IAM, Step Functions and X-Ray information used to develop and maintain them, without changing anything.

Best practices

AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases.

Security considerations

The policy can read Lambda log data: logs:GetLogEvents, logs:FilterLogEvents, logs:StartQuery and logs:StartLiveTail on /aws/lambda/* log groups.
It also lets the user read IAM roles and policies (iam:GetRole, iam:GetRolePolicy, iam:ListRoles and related actions) on all resources.
You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Lambda is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case.

Same service

Same domain

Frequently asked questions

When should I attach AWSLambda_ReadOnlyAccess?: The AWS Lambda Developer Guide says you can attach it to your users, groups and roles and that it grants read-only access to Lambda resources and related services. Attach it where viewing Lambda is the intended scope.
What does AWSLambda_ReadOnlyAccess grant?: It allows lambda:Get* and lambda:List* and describe, list and get actions for CloudFormation, CloudWatch, Amazon EC2, AWS KMS, IAM, CloudWatch Logs, AWS Step Functions, tagging and AWS X-Ray on all resources, plus log reads and queries on /aws/lambda/* log groups.
What are the security risks of AWSLambda_ReadOnlyAccess?: It has no Lambda create, update or delete action, but it can read Lambda log data and IAM role and policy details. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:ListStacks",
        "cloudformation:ListStackResources",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "kms:ListAliases",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:GetRole",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:ListRoles",
        "logs:DescribeLogGroups",
        "lambda:Get*",
        "lambda:List*",
        "states:DescribeStateMachine",
        "states:ListStateMachines",
        "tag:GetResources",
        "xray:GetTraceSummaries",
        "xray:BatchGetTraces"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:DescribeLogStreams",
        "logs:GetLogEvents",
        "logs:FilterLogEvents",
        "logs:StartQuery",
        "logs:StopQuery",
        "logs:DescribeQueries",
        "logs:GetLogGroupFields",
        "logs:GetLogRecord",
        "logs:GetQueryResults",
        "logs:StartLiveTail",
        "logs:StopLiveTail"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*"
    }
  ]
}

Version history

Current version v5, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "awslambda_readonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSLambda_ReadOnlyAccess"),
);

Sources

AWSLambda_ReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, assignmentGuidance, faqs)
AWS managed policies for AWS Lambda (AWS Lambda Developer Guide) (retrieved 2026-11-12; supports summary, useCases, bestPractices, securityConsiderations, assignmentGuidance, faqs)
Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)