How to setup IAM policy for AWS Lambda in VPC to resolve error "You are not authorized to perform: CreateNetworkInterface."

Question

I am trying to setup my Lambda to access my Mongo server on one of the EC2 instances in VPC. After selecting all the subnets and security groups, I get the following error when saving "You are not authorized to perform: CreateNetworkInterface."

I believe, I need some sort of policy setup in AWS IAM to allow this.

I have "AdministratorAccess" and I am trying to add IAM role to my account.

Does anyone know what policy/role I need for this?

Answer 1

Gotcha!!! If the error message said "This Lambda function is not authorized to perform: CreateNetworkInterface" then it would have made more sense that the Lambda role needs to be modified with appropriate policy. Fixed the problem by adding the policy to the role that the Lambda was using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Resource": "*",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:CreateNetworkInterface",
                "ec2:AttachNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "autoscaling:CompleteLifecycleAction",
                "ec2:DeleteNetworkInterface"
            ]
        }
        ]
}

Answer 2

There is an AWS Managed policy that includes the required permissions to allow the Lambda function to manage it's ENI interfaces.

Add this policy to the execution role of the Lambda function: arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess

The permissions contained, as of 01/09/2024, are as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:AssignPrivateIpAddresses",
                "ec2:UnassignPrivateIpAddresses"
            ],
            "Resource": "*"
        }
    ]
}

Answer 3

It is necessary to provide the lambda with the policy actions:

NetworkLambdaRole:
 Type: "AWS::IAM::Role"
 Properties:
   RoleName: "Network-Lambda-Role"
   AssumeRolePolicyDocument:
     Version: '2012-10-17'
     Statement:
     -
       Effect: "Allow"
       Principal:
         Service:
         - "lambda.amazonaws.com"
       Action:
       - "sts:AssumeRole"
   Policies:
   - PolicyName: "network-lambda-role-policy"
     PolicyDocument:
       Version: '2012-10-17'
       Statement:
       - Effect: "Allow"
         Action: [
           "ec2:DescribeInstances",
           "ec2:CreateNetworkInterface",
           "ec2:AttachNetworkInterface",
           "ec2:DescribeNetworkInterfaces",
           "ec2:DeleteNetworkInterface"
         ]
         Resource: "*"

Note: the answer from blueskin was missing the policy ec2:DeleteNetworkInterfaces