Setting up the IAM role and policies

An IAM role is created to run the Lambda function. Three policies attach to the IAM role. The first one is a user-managed policy which grants permissions to operation on the S3 bucket my-aws-lambda-guardduty. The second one is a user-managed policy which grants permission to operation on the DynamoDB table my-aws-lambda-guardduty-db. The third one is an AWS-managed policy which allows the Lambda function to write logs to CloudWatch.

1. Create a policy to operate on the S3 bucket.
   1. Choose S3 as its service.
   2. In Access level, add ListBucket on List, HeadBucket and GetObject on Read, PutObject on Write, and PutObjectAcl on Permissions management.
   3. In Resources, choose Specific.
      1. For the bucket resource type, add the my-aws-lambda-guardduty S3 bucket ARN (for example, arn:aws:s3:::my-aws-lambda-guardduty) to restrict access to any file in the specific bucket only.
      2. For the object resource type, add the my-aws-lambda-guardduty S3 bucket ARN and a /* wildcard (for example, *arn:aws:s3:::my-aws-lambda-guardduty/**) to restrict access to any file in the specific bucket only.
   4. Click Review Policy, then Save Changes. The policy in JSON form looks like the code snippet below:

      {

      "Version": "2012-10-17",

      "Statement": [

      "{

      "Sid": "VisualEditor0",

      "Effect": "Allow",

      "Action": [

      "s3:PutObject",

      "s3:GetObject",

      "s3:ListBucket",

      "s3:PutObjectAcl"

      "],

      "Resource": [

      "arn:aws:s3:::my-aws-lambda-guardduty",

      "arn:aws:s3:::my-aws-lambda-guardduty/*"

      ]

      },

      {

      "Sid": "VisualEditor1",

      "Effect": "Allow",

      "Action": "s3:HeadBucket",

      "Resource": "*"

      }

      ]

      }

2. Create a policy to operate on the DynamoDB table.
   1. Choose DynamoDB as its service.
   2. In Access level, add ListStreams on List, DescribeStream, GetRecords, GetShardIterator, Scan on Read, and UpdateItem on Write.
   3. In Resources, choose Specific.
      1. For the stream resource type, add the my-aws-lambda-guardduty-db latest stream ARN (for example,arn:aws:dynamodb:us-east-1:888888888888:table/my-aws-lambda-guardduty-db/2018-07-20T10:30:10.888). Replace the Stream label content with the * wildcard to allow for access to any stream resource of the my-aws-lambda-guardduty-db table.
      2. Forthe table resource type, add the my-aws-lambda-guardduty-db DynamoDB table ARN (for example, arn:aws:dynamodb:us-east-1:888888888888:table/my-aws-lambda-guardduty-db) to restrict access to the specific table only.
   4. Click Review Policy, then Save Changes. The policy in JSON form looks like the code snippet below:

      {

      "Version": "2012-10-17",

      "Statement": [

      {

      "Sid": "VisualEditor0",

      "Effect": "Allow",

      "Action": [

      "dynamodb:GetShardIterator",

      "dynamodb:Scan",

      "dynamodb:UpdateItem",

      "dynamodb:DescribeStream",

      "dynamodb:GetRecords"

      ],

      "Resource": [

      "arn:aws:dynamodb:us-east-1:888888888888:table/my-aws-lambda-guardduty-db/stream/*",

      "arn:aws:dynamodb:us-east-1:888888888888:table/my-aws-lambda-guardduty-db"

      ]

      },

      {

      "Sid": "VisualEditor1",

      "Effect": "Allow",

      "Action": "dynamodb:ListStreams",

      "Resource": "*"

      }

      ]

      }

3. Create an IAM role to run the Lambda function.
   1. Choose the Lamba service that will use this role.
   2. Attach the two user-managed policies created in the previous steps to this role.
   3. Attach the AWS-managed policy AWSLambdaBasicExecutionRole to this role.