How to setup IAM policy for AWS Lambda in VPC to resolve error "You are not authorized to perform: CreateNetworkInterface."

Question

I am trying to setup my Lambda to access my Mongo server on one of the EC2 instances in VPC. After selecting all the subnets and security groups, I get the following error when saving "You are not authorized to perform: CreateNetworkInterface."

I believe, I need some sort of policy setup in AWS IAM to allow this.

I have "AdministratorAccess" and I am trying to add IAM role to my account.

Does anyone know what policy/role I need for this?

Are you trying to launch an instance? Error message is not related to what you are trying to do. — helloV, Feb 12 '16 at 17:10
Nope, just trying to setup my lambda to access my VPC resources — Chenna V, Feb 12 '16 at 17:25

score 27 · Accepted Answer · edited Feb 05 '23 at 21:59

Gotcha!!! If the error message said "This Lambda function is not authorized to perform: CreateNetworkInterface" then it would have made more sense that the Lambda role needs to be modified with appropriate policy. Fixed the problem by adding the policy to the role that the Lambda was using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Resource": "*",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:CreateNetworkInterface",
                "ec2:AttachNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "autoscaling:CompleteLifecycleAction",
                "ec2:DeleteNetworkInterface"
            ]
        }
        ]
}

When I was creating the Lambda I got error for missing `"ec2:DeleteNetworkInterface"`. I've added it and it all worked. — nyxz, Sep 27 '21 at 13:06

score 18 · Answer 2 · answered Jan 16 '18 at 12:04

It is necessary to provide the lambda with the policy actions:

NetworkLambdaRole:
 Type: "AWS::IAM::Role"
 Properties:
   RoleName: "Network-Lambda-Role"
   AssumeRolePolicyDocument:
     Version: '2012-10-17'
     Statement:
     -
       Effect: "Allow"
       Principal:
         Service:
         - "lambda.amazonaws.com"
       Action:
       - "sts:AssumeRole"
   Policies:
   - PolicyName: "network-lambda-role-policy"
     PolicyDocument:
       Version: '2012-10-17'
       Statement:
       - Effect: "Allow"
         Action: [
           "ec2:DescribeInstances",
           "ec2:CreateNetworkInterface",
           "ec2:AttachNetworkInterface",
           "ec2:DescribeNetworkInterfaces",
           "ec2:DeleteNetworkInterface"
         ]
         Resource: "*"

Note: the answer from blueskin was missing the policy ec2:DeleteNetworkInterfaces

How to setup IAM policy for AWS Lambda in VPC to resolve error "You are not authorized to perform: CreateNetworkInterface."

2 Answers2