Lambda function - Under the hood

DevOps AWS
#1

What is actually happening under the hood when a Lambda function is given permission for an action? I’m basically asking how IAM works under the hood.

For example, suppose that a lambda function is given permission to put events into an event bus, i.e., events:putEvents

How does the eventbridge really know that the caller has the appropriate permissions? At the end putEvents is nothing but an HTTP call.

#2

That’s quite a complicated question and given who is in this Slack and the requested level of implementation details, you might not get an answer.

Having built a SaaS that mimics what IAM does but for customers I can share some insight into what we do, but I don’t know how much that is going help. What are you hoping to figure out?

#3

I needed to call a mutation on AppSync from within Lambda in order to trigger an AppSync subscription.

I wanted to use IAM instead of API Key, but I was not able to do it, and looking at the function, it really makes sense. I would be more surprised if it worked… Because there is nothing in the function code that somehow carries the IAM info.

The function body is more or like this:

	const { id } = event.detail

	const query = `mutation CreateOrUpdateTotal($id: ID!) {
            createOrUpdateTotal(id: $id) {
                 ...fields
            }
        }`

	const payload = {
		query,
		variables: { id },
		operationName: 'CreateOrUpdateTotal'
	}

	await [axios.post](http://axios.post)(graphqlUrl, payload})
}```
#4

But when there is an aws sdk client, it just works, for example:


new AWS.EventBridge().putEvents({ ... })```
So I’m just assuming that the SDK does something under the hood, and I just don’t see any way other than reading temporary credentials from environment, and adding to the http request headers.
#5

Appsync doesn’t take IAM credentials as far as I’m aware. Yes the AWS SDK automatically loads your credentials from the current environment to make the call to AWS services

#6

What do you mean that appsync doesnt take IAM credentials?

#7

Because it does support IAM Authorization

#8

Well then you need to provide it explicitly into the request

#9

You’ll have to find the instructions for your selected language

#10

It’s not trivially to sign your requests though