AWS Boto3: See Permissions Required to Run Code Successfully - amazon-web-services

Question

Let's say I have a lambda function on AWS running some boto3 code. This boto3 code interacts with a variety of AWS resources, such as CloudWatch, S3, SNS, Lambda etc. In the execution role, I obviously may need to add certain permissions, such as lambda::CreateFunction as an example.
Now I want to add a permission policy to this function and add all the necessary permissions. Currently the only way to do this seems to be to run the code, read the error about it not having access to a certain permission, and then adding that permission to the permission policy. This can get very tedious and time consuming, especially when the code interacts with a large variety of different AWS resources.
So my question is, are there any ways to just see what permissions the boto3 code will require before running it? Maybe somebody has made a script for this before that reads through the code and prints out the permissions that would be necessary to run it?

Answer 1

If you build your services using the AWS Cloud Development Kit (CDK), then you can simplify the process of granting your Lambda permissions to the correct services.
As a simple example, say you have a Lambda function and a DynamoDB table. You design the infrastructure in CDK with something like this:
const someTable = new dynamodb.Table(this, 'someTable', {
tableName: 'someTable',
billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
partitionKey: {name: 'id', type: dynamodb.AttributeType.STRING},
});
const someLambdaFunction = new lambda.Function(this, 'someLambdaFunction', {
functionName: 'someLambdaFunction',
runtime: lambda.Runtime.NODEJS_16_X,
handler: 'index.handler',
memorySize: 128,
timeout: cdk.Duration.seconds(10),
code: lambda.Code.fromAsset(path.join(__dirname, '../yourpath')),
});
And then you can grant permissions in one line:
someTable.grantFullAccess(someLambdaFunction);
CDK then generates the CloudFormation templates with the correct roles and permissions.