AWS Lambda 2026-08-30

Use these rules for AWS Lambda Event Functions, including default compute, Managed Instances, and durable functions where supported. The 2026-08-30 identifier is the retained snapshot name; this guidance is maintained against current service behavior. Lambda Web Functions and Lambda MicroVMs have separate APIs and are not covered here. Apply the relevant language and framework security guidance alongside these rules. Treat each trigger, execution role, event payload, warm environment, and downstream service as a distinct trust boundary.

Execution identity

• Assign a dedicated execution role to each trust boundary and grant only required actions and resources.
• Trust lambda.amazonaws.com to assume the execution role; do not add unrelated principals or self-assumption unless the application requires it.
• Use resource ARNs and IAM conditions to constrain accounts, regions, prefixes, tags, source ARNs, and source accounts.
• Keep deployment, execution, administration, and break-glass roles separate.
• Restrict deployer iam:PassRole to exact role ARNs plus iam:PassedToService = lambda.amazonaws.com; the condition alone cannot restrict roles. Forbid deployer AWSLambda_FullAccess: its lambda:*/any-role passing permits function creation/updates executing with any passed role.
• Treat lambda:CreateFunction, lambda:UpdateFunctionCode, lambda:UpdateFunctionConfiguration as execution-role code execution: layers and AWS_LAMBDA_EXEC_WRAPPER, NODE_OPTIONS, JAVA_TOOL_OPTIONS, DOTNET_STARTUP_HOOKS load startup code. Grant only to pipelines for owned