AWS Lambda Lambda Policy API

openapi: 3.2.0
info:
  title: AWS Lambda Policy API
  version: '2015-03-31'
  description: Generated from AWS's published Smithy model for AWS Lambda. 6 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://lambda.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Policy
paths:
  /2015-03-31/functions/{FunctionName}/policy:
    get:
      operationId: GetPolicy
      summary: Get Policy
      description: Returns the resource-based IAM policy for a function, version, or alias.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetPolicyResponse'
              example:
                Policy: '{"Version":"2012-10-17","Id":"default","Statement":[{"Sid":"xaccount","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"lambda:InvokeFunction","Resource":"arn:aws:lambda:us-east-2:123456789012:function:my-function:1"}]}'
                RevisionId: 4843f2f6-7c59-4fda-b484-afd0bc0e22b8
        '400':
          description: InvalidParameterValueException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetPolicyRequest'
            example:
              FunctionName: my-function
              Qualifier: '1'
      tags:
      - Policy
    post:
      operationId: AddPermission
      summary: Add Permission
      description: 'Grants a principal permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function. Note: Lambda does not support adding policies to version $LATEST. To grant permission to another account, specify the account ID as the Principal. To grant permission to an organization defined in Organizations, specify the organization ID as the PrincipalOrgID. For Amazon Web Services services, the principal is a domain-style identifier that the service defines, such as s3.amazonaws.com or sns.amazonaws.com. For Amazon Web Services services, you can also specify the ARN of the associated resource as the SourceArn. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. This operation adds a statement to a resource-based permissions policy for the function. For more information about function policies, see Using resource-based policies for Lambda.'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddPermissionResponse'
              example:
                Statement: '{"Sid":"s3","Effect":"Allow","Principal":{"Service":"s3.amazonaws.com"},"Action":"lambda:InvokeFunction","Resource":"arn:aws:lambda:us-east-2:123456789012:function:my-function","Condition":{"StringEquals":{"AWS:SourceAccount":"123456789012"},"ArnLike":{"AWS:SourceArn":"arn:aws:s3:::my-bucket-1xpuxmplzrlbh"}}}'
        '400':
          description: InvalidParameterValueException; PolicyLengthExceededException; PublicPolicyException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '412':
          description: PreconditionFailedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreconditionFailedException'
        '409':
          description: ResourceConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceConflictException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddPermissionRequest'
            example:
              Action: lambda:InvokeFunction
              FunctionName: my-function
              Principal: s3.amazonaws.com
              SourceAccount: '123456789012'
              SourceArn: arn:aws:s3:::my-bucket-1xpuxmplzrlbh/*
              StatementId: s3
      tags:
      - Policy
  /2018-10-31/layers/{LayerName}/versions/{VersionNumber}/policy:
    post:
      operationId: AddLayerVersionPermission
      summary: Add Layer Version Permission
      description: Adds permissions to the resource-based policy of a version of an Lambda layer. Use this action to grant layer usage permission to other accounts. You can grant permission to a single account, all accounts in an organization, or all Amazon Web Services accounts. To revoke permission, call RemoveLayerVersionPermission with the statement ID that you specified when you added it.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddLayerVersionPermissionResponse'
              example:
                RevisionId: 35d87451-f796-4a3f-a618-95a3671b0a0c
                Statement: '{"Sid":"xaccount","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::223456789012:root"},"Action":"lambda:GetLayerVersion","Resource":"arn:aws:lambda:us-east-2:123456789012:layer:my-layer:1"}'
        '400':
          description: InvalidParameterValueException; PolicyLengthExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '412':
          description: PreconditionFailedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreconditionFailedException'
        '409':
          description: ResourceConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceConflictException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddLayerVersionPermissionRequest'
            example:
              Action: lambda:GetLayerVersion
              LayerName: my-layer
              Principal: '223456789012'
              StatementId: xaccount
              VersionNumber: 1
      tags:
      - Policy
    get:
      operationId: GetLayerVersionPolicy
      summary: Get Layer Version Policy
      description: Returns the permission policy for a version of an Lambda layer. For more information, see AddLayerVersionPermission.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLayerVersionPolicyResponse'
        '400':
          description: InvalidParameterValueException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetLayerVersionPolicyRequest'
      tags:
      - Policy
  /2018-10-31/layers/{LayerName}/versions/{VersionNumber}/policy/{StatementId}:
    delete:
      operationId: RemoveLayerVersionPermission
      summary: Remove Layer Version Permission
      description: Removes a statement from the permissions policy for a version of an Lambda layer. For more information, see AddLayerVersionPermission.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: string
        '400':
          description: InvalidParameterValueException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '412':
          description: PreconditionFailedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreconditionFailedException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoveLayerVersionPermissionRequest'
            example:
              LayerName: my-layer
              StatementId: xaccount
              VersionNumber: 1
      tags:
      - Policy
  /2015-03-31/functions/{FunctionName}/policy/{StatementId}:
    delete:
      operationId: RemovePermission
      summary: Remove Permission
      description: Revokes function-use permission from an Amazon Web Services service or another Amazon Web Services account. You can get the ID of the statement from the output of GetPolicy.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: string
        '400':
          description: InvalidParameterValueException; PublicPolicyException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '412':
          description: PreconditionFailedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreconditionFailedException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemovePermissionRequest'
            example:
              FunctionName: my-function
              Qualifier: PROD
              StatementId: xaccount
      tags:
      - Policy
components:
  schemas:
    ResourceConflictException:
      type: object
      properties:
        Type:
          type: string
          description: The exception type.
        message:
          type: string
          description: The exception message.
    AddLayerVersionPermissionRequest:
      type: object
      properties:
        LayerName:
          type: string
          description: The name or Amazon Resource Name (ARN) of the layer.
        VersionNumber:
          type: integer
          description: The version number.
        StatementId:
          type: string
          description: An identifier that distinguishes the policy from others on the same layer version.
        Action:
          type: string
          description: The API action that grants access to the layer. For example, lambda:GetLayerVersion.
        Principal:
          type: string
          description: An account ID, or * to grant layer usage permission to all accounts in an organization, or all Amazon Web Services accounts (if organizationId is not specified). For the last case, make sure that you really do want all Amazon Web Services accounts to have usage permission to this layer.
        OrganizationId:
          type: string
          description: With the principal set to *, grant permission to all accounts in the specified organization.
        RevisionId:
          type: string
          description: Only update the policy if the revision ID matches the ID specified. Use this option to avoid modifying a policy that has changed since you last read it.
      required:
      - LayerName
      - VersionNumber
      - StatementId
      - Action
      - Principal
    GetLayerVersionPolicyResponse:
      type: object
      properties:
        Policy:
          type: string
          description: The policy document.
        RevisionId:
          type: string
          description: A unique identifier for the current revision of the policy.
    GetPolicyRequest:
      type: object
      properties:
        FunctionName:
          type: string
          description: The name or ARN of the Lambda function, version, or alias. Name formats Function name – my-function (name-only), my-function:v1 (with alias). Function ARN – arn:aws:lambda:us-west-2:123456789012:function:my-function. Partial ARN – 123456789012:function:my-function. You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.
        Qualifier:
          type: string
          description: Specify a version or alias to get the policy for that resource.
      required:
      - FunctionName
    RemoveLayerVersionPermissionRequest:
      type: object
      properties:
        LayerName:
          type: string
          description: The name or Amazon Resource Name (ARN) of the layer.
        VersionNumber:
          type: integer
          description: The version number.
        StatementId:
          type: string
          description: The identifier that was specified when the statement was added.
        RevisionId:
          type: string
          description: Only update the policy if the revision ID matches the ID specified. Use this option to avoid modifying a policy that has changed since you last read it.
      required:
      - LayerName
      - VersionNumber
      - StatementId
    GetLayerVersionPolicyRequest:
      type: object
      properties:
        LayerName:
          type: string
          description: The name or Amazon Resource Name (ARN) of the layer.
        VersionNumber:
          type: integer
          description: The version number.
      required:
      - LayerName
      - VersionNumber
    GetPolicyResponse:
      type: object
      properties:
        Policy:
          type: string
          description: The resource-based policy.
        RevisionId:
          type: string
          description: A unique identifier for the current revision of the policy.
    TooManyRequestsException:
      type: object
      properties:
        retryAfterSeconds:
          type: string
          description: The number of seconds the caller should wait before retrying.
        Type:
          type: string
        message:
          type: string
        Reason:
          type: string
          enum:
          - ConcurrentInvocationLimitExceeded
          - FunctionInvocationRateLimitExceeded
          - ReservedFunctionConcurrentInvocationLimitExceeded
          - ReservedFunctionInvocationRateLimitExceeded
          - CallerRateLimitExceeded
          - ConcurrentSnapshotCreateLimitExceeded
    AddPermissionResponse:
      type: object
      properties:
        Statement:
          type: string
          description: The permission statement that's added to the function policy.
    InvalidParameterValueException:
      type: object
      properties:
        Type:
          type: string
          description: The exception type.
        message:
          type: string
          description: The exception message.
    PreconditionFailedException:
      type: object
      properties:
        Type:
          type: string
          description: The exception type.
        message:
          type: string
          description: The exception message.
    AddPermissionRequest:
      type: object
      properties:
        FunctionName:
          type: string
          description: The name or ARN of the Lambda function, version, or alias. Name formats Function name – my-function (name-only), my-function:v1 (with alias). Function ARN – arn:aws:lambda:us-west-2:123456789012:function:my-function. Partial ARN – 123456789012:function:my-function. You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.
        StatementId:
          type: string
          description: A statement identifier that differentiates the statement from others in the same policy.
        Action:
          type: string
          description: The action that the principal can use on the function. For example, lambda:InvokeFunction or lambda:GetFunction.
        Principal:
          type: string
          description: The Amazon Web Services service, Amazon Web Services account, IAM user, or IAM role that invokes the function. If you specify a service, use SourceArn or SourceAccount to limit who can invoke the function through that service.
        SourceArn:
          type: string
          description: For Amazon Web Services services, the ARN of the Amazon Web Services resource that invokes the function. For example, an Amazon S3 bucket or Amazon SNS topic. Note that Lambda configures the comparison using the StringLike operator.
        FunctionUrlAuthType:
          type: string
          enum:
          - NONE
          - AWS_IAM
          description: The type of authentication that your function URL uses. Set to AWS_IAM if you want to restrict access to authenticated users only. Set to NONE if you want to bypass IAM authentication to create a public endpoint. For more information, see Control access to Lambda function URLs.
        InvokedViaFunctionUrl:
          type: boolean
          description: Indicates whether the permission applies when the function is invoked through a function URL.
        SourceAccount:
          type: string
          description: For Amazon Web Services service, the ID of the Amazon Web Services account that owns the resource. Use this together with SourceArn to ensure that the specified account owns the resource. It is possible for an Amazon S3 bucket to be deleted by its owner and recreated by another account.
        EventSourceToken:
          type: string
          description: For Alexa Smart Home functions, a token that the invoker must supply.
        Qualifier:
          type: string
          description: Specify a version or alias to add permissions to a published version of the function.
        RevisionId:
          type: string
          description: Update the policy only if the revision ID matches the ID that's specified. Use this option to avoid modifying a policy that has changed since you last read it.
        PrincipalOrgID:
          type: string
          description: The identifier for your organization in Organizations. Use this to grant permissions to all the Amazon Web Services accounts under this organization.
      required:
      - FunctionName
      - StatementId
      - Action
      - Principal
    AddLayerVersionPermissionResponse:
      type: object
      properties:
        Statement:
          type: string
          description: The permission statement.
        RevisionId:
          type: string
          description: A unique identifier for the current revision of the policy.
    RemovePermissionRequest:
      type: object
      properties:
        FunctionName:
          type: string
          description: The name or ARN of the Lambda function, version, or alias. Name formats Function name – my-function (name-only), my-function:v1 (with alias). Function ARN – arn:aws:lambda:us-west-2:123456789012:function:my-function. Partial ARN – 123456789012:function:my-function. You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.
        StatementId:
          type: string
          description: Statement ID of the permission to remove.
        Qualifier:
          type: string
          description: Specify a version or alias to remove permissions from a published version of the function.
        RevisionId:
          type: string
          description: Update the policy only if the revision ID matches the ID that's specified. Use this option to avoid modifying a policy that has changed since you last read it.
      required:
      - FunctionName
      - StatementId
    ResourceNotFoundException:
      type: object
      properties:
        Type:
          type: string
        Message:
          type: string
    ServiceException:
      type: object
      properties:
        Type:
          type: string
        Message:
          type: string
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: lambda
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/lambda/service/2015-03-31/lambda-2015-03-31.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)