AWS Lambda - The role defined for the function cannot be assumed by Lambda

Question

I am trying to access Lambda function using iOS Swift and here is my set up AWS Role

1. RoleName: ALLOW_LAMBDA_EXECUTE
   • With Policy access to AWS Lambda full access, AWS Lambda execute, AmazonCognitoDeveloperAuthenticatedIdentities
   • Trust Relationship: Allow services: lambda.amazonaws.com and condition has Cognito identity with "unauthenticated"
2. Cognito Identity Pool: Has the role ALLOW_LAMBDA_EXECUTE under unauthenticated role
3. Unauthenticated Identities: Has Enable access to unauthenticated identities checked
4. In Lambda, for function GetProcess(), has ExecutionRole: ALLOW_LAMBDA_EXECUTION

with all these, when I execute the same using my iPhone app (with simulator), I get this error.

"x-amzn-errortype" = **AccessDeniedException**;

-[AWSJSONResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response body:
**{"Message":"The role defined for the function cannot be assumed by Lambda."}**

Am I missing anything here?

Answer 1

After a lot of deliberation, going through multiple docs and doing some RnD, things started working.

Yes, Trust Relationship should have lambda execute and Action: sts:AssumeRoleWithWebIdentity and it should have the condition

{
"Version": "2018-1-30",
"Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com",
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "identity-pool"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "unauthenticated"
        }
      }
    }
  ]
}

Now, this will not work well with Lambdas role coz' it cannot assume the role, which I think make-sense as it has little power to do so.

Hence I have created 2 diff roles Role 1- with above trust relationship assigned to Cognito fedrated identitiy access Role 2- without changes in trust relationship assigned to Lambda role.

Now both my iOS access works with cognito identity and also AWS APIMicroServices...

Indeed took a while to crack this.

Answer 2

Seems like you configured your Cognito role to be assumed by Lambda.

You have to set the following Trust Relationship for the role ALLOW_LAMBDA_EXECUTION not ALLOW_LAMBDA_EXECUTE:

{
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "Service": "lambda.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
  }
}