Introduction

AWS Lambda@Edge is a powerful extension of AWS Lambda that allows you to execute code closer to your end-users, improving performance and reducing latency. However, when deploying applications to Lambda@Edge, you might encounter the error: `execution role must be assumable`. Understanding the root cause of this error and how to resolve it is essential for a smooth deployment.

Understanding IAM Roles in AWS

IAM (Identity and Access Management) roles in AWS are a fundamental aspect of managing permissions for AWS resources. Roles are primarily used to delegate access, and they allow services like Lambda to execute specific actions on your behalf.

Key Concepts

• Execution Role: The IAM role that a Lambda function assumes when it is executed. This role needs the necessary permissions to access required AWS resources.
• Trust Policy: This JSON document defines which entities are permitted to assume the role.

Reason for 'Execution Role Must Be Assumable' Error

The error "execution role must be assumable" typically indicates that the IAM role associated with your Lambda function does not have the correct trust policy. This means services such as Lambda@Edge do not have permission to assume this role and consequently cannot execute your function.

Common Causes

1. Invalid Trust Policy: The trust policy does not include the proper permissions for the `edgelambda.amazonaws.com` service to assume the role.
2. Role Misconfiguration: The role may not exist, or it might be improperly defined in your deployment configuration.
3. Permissions Boundary: If your organization uses policies that restrict permissions, it might prevent the Lambda function from assuming roles.

Example of Correct Trust Policy

To correct the error, you must ensure your IAM role has an appropriate trust policy. Here's an example of a trust policy that allows Lambda@Edge to assume the role:

• Verify that the execution role exists and is correctly specified in your deployment script or template.
• Ensure the trust policy includes `edgelambda.amazonaws.com` as the principal.
• Use tools like IAM Policy Simulator or AWS CLI to validate your policy.
• Confirm that the execution role has the necessary permissions for your Lambda function to interact with other AWS services.
• Check if there are any permissions boundaries or service control policies that might restrict role assumption.
• List IAM Roles:
• Get Trust Policy of a Role:
• Update a Trust Policy: