Getting a 403 when using the conventions in lambda.go but not when creating a session per AWS docs?

[S4lt5]

Hi... I was getting a 403 AccessDeniedException repeatedly when running nuclearpond in my environment.

I've successfully deployed via terraform and can test the lambda via CLI and Python boto3, getting expected results.

However, when running nuclearpond the invokeFunction was always failing and returning a 403 / AccessDenied.

I looked at https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/lambda-go-example-run-function.html and since I was getting desperate, I changed the code to more or less exactly match what was there.

I was a little surprised when that actually worked. I'm not sure the difference but using the following implementation for invokeFunction gave me no errors at all. Can anyone else reproduce this behavior or is this a "me" thing?

// Execute a lambda function and return the response
func invokeFunction(payload string, functionName string) (string, error) {
	// Create a new session

	sess := session.Must(session.NewSessionWithOptions(session.Options{
		SharedConfigState: session.SharedConfigEnable,
	}))

	// Create a Lambda service client.
	svc := lambda.New(sess, &aws.Config{
		Region: aws.String("us-east-1")},
	)

	// Create the input
	input := &lambda.InvokeInput{
		FunctionName: aws.String(functionName),
		Payload:      []byte(payload),
	}

[jonathanwalker]

Interesting! Can you provide the full output of the error, perhaps it is the function that's receiving that message? Not sure. Thanks for creating the issue!

[S4lt5]

Sure, it was a bit weird actually I just got a HTTP 403 that seemed to be associated with how the session was created. I can manually invoke the function via CLI, execute it via boto3, but in the standard nuclearpond method I get a AccessDeniedError when executing the lambda. No extra error info. When I run the above code instead, it works every time.

I do 0 golang in my day job so I just tried cut and paste the standard AWS tutorial code and was a bit surprised to find out it works. I'll add a screenshot to this as soon as I get back in there.