Getting AccessDenied when trying to issue a Lamba function, but why? - python-2.7

Question

I've created an AWS Lambda function which is supposed to copy InstanceDBSnapshots from one region to another.
The following policies are attached to the role:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1510479591000",
"Effect": "Allow",
"Action": [
"rds:CreateDBInstance",
"rds:CreateDBSecurityGroup",
"rds:CreateDBSnapshot",
"rds:CreateDBSubnetGroup",
"rds:DeleteDBInstance",
"rds:DeleteDBSecurityGroup",
"rds:DeleteDBSnapshot",
"rds:DeleteDBSubnetGroup",
"rds:DescribeDBInstances",
"rds:DescribeDBSecurityGroups",
"rds:DescribeDBSnapshotAttributes",
"rds:DescribeDBSnapshots",
"rds:DescribeDBSubnetGroups",
"rds:ModifyDBInstance",
"rds:ModifyDBSubnetGroup",
"rds:RestoreDBInstanceFromDBSnapshot"
],
"Resource": [
"arn:aws:rds:*"
]
}
]
}
And an Amazon policy called: "AWSLambdaBasicExecutionRole".
When I run the function I get the following error:
START RequestId: c5f62f26-c7b6-11e7-8fd4-c9b54c37d712 Version: $LATEST
An error occurred (AccessDenied) when calling the DescribeDBSnapshots
operation: User:
arn:aws:sts::ACCOUNT:assumed-role/cc/Cross-Copy-DB-Snapshots is not
authorized to perform: rds:DescribeDBSnapshots: ClientError
I don't understand what is that "arn:aws:sts" and how to allow this function to run properly.
Anyone knows this issue and how to solve it?

Answer 1

Something is wrong with your role; this should work:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*",
"Effect": "Allow"
},
{
"Action": [
"rds:DescribeDBSnapshots",
"rds:DeleteDBSnapshot",
"rds:CopyDBSnapshot"
],
"Resource": "*",
"Effect": "Allow"
}
]
}