IAM Role for Lambda

  1. In the AWS Console, search “iam” and choose IAM
1-iam

  1. Next, we need to create policies first. Choose Policies in the left panel > Create Policy 2-iam

  2. Copy this JSON policies for our lambda function

NOTE: In the Resource property, you must change the specified ARN you want to allow, for simple i group all service into an array, this is not recommend.

{
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Action" : [
          "s3:GetObject",
          "s3:ListBucket",
          "sqs:SendMessage",
          "sqs:GetQueueUrl",
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ],
        "Resource" : "*"
      }
    ]
}

// Or you can use best practice for policies (Replace your account id with <account-id>)
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::ai-powered-email-auto-replies/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::ai-powered-email-auto-replies"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-1:<account-id>:log-group:/aws/lambda/ExtractEmailLambda:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage"
            ],
            "Resource": "arn:aws:sqs:us-east-1:<account-id>:generated-email-queue"
        }
    ]
}

Choose JSON > paste JSON above > Next

3-iam
  1. At the Policy name we put it as ExtractEmailFunctionPolicy and choose Create policy
4-iam

Success created policies

5-iam

  1. Choose Roles > Create role 6-iam

  2. At the use case we choose Lambda > Next 7-iam

  3. Choose our ExtractEmailFunctionPolicy and Next 8-iam

  4. Insert our role name ExtractEmailFunctionRole 9-iam

  5. Choose Create role

10-iam
  1. Success create ExtractEmailLambdaRole
11-iam

Ok, Let’s create 2 remaining roles

Please repeat from step 1 to create 2 remaining roles with configuration below

  1. Generate email lambda function role
ConfigurationValue
roleGenerateEmailFunctionRole
policyGenerateEmailFunctionPolicy

NOTE: In real life, the Resource property, you must change the specified ARN you want to allow, for simple i am using wildcard for all components in that service, this is not recommend.

{
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect": "Allow",
        "Action": [
          "bedrock:InvokeModel",
          "bedrock:ListKnowledgeBases", 
          "bedrock:GetKnowledgeBase",
          "bedrock:Retrieve",
          "bedrock:RetrieveAndGenerate",
          "bedrock:ListAgents",
          "bedrock:GetAgent",
          "bedrock:InvokeAgent"
        ],
        "Resource": [
          "arn:aws:bedrock:us-east-1::foundation-model/*",
          "arn:aws:bedrock:us-east-1:<account-id>:knowledge-base/*",
          "arn:aws:bedrock:us-east-1:<account-id>:agent/*",
          "arn:aws:bedrock:us-east-1:<account-id>:agent-alias/*"
        ]
      },
      {
            "Effect": "Allow",
            "Action": [
                "sqs:SendMessage",
                "sqs:ReceiveMessage",
                "sqs:GetQueueUrl",
                "sqs:DeleteMessage",
                "sqs:GetQueueAttributes"
            ],
            "Resource": "arn:aws:sqs:us-east-1:<account-id>:sqs-send-email-to-customer-queue"
        },
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:Scan", 
                "dynamodb:Query",
                "dynamodb:GetItem"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:<account-id>:table/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-1:<account-id>:log-group:/aws/lambda/GenerateEmailLambda:*"
        }
    ]
  }
  1. Send email lambda function role
ConfigurationValue
roleSendEmailFunctionRole
policySendEmailFunctionPolicy
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow", 
            "Action": [
                "sqs:SendMessage",
                "sqs:ReceiveMessage",
                "sqs:GetQueueUrl",
                "sqs:DeleteMessage",
                "sqs:GetQueueAttributes"
            ],
            "Resource": "arn:aws:sqs:us-east-1:<account-id>:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail"
            ],
            "Resource": "arn:aws:ses:us-east-1:<account-id>:identity/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::ai-powered-email-auto-replies"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::ai-powered-email-auto-replies/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-1:<account-id>:log-group:/aws/lambda/GenerateEmailLambda:*"
        }
    ]
}

After created, you can go next, we will use these roles in the Lambda section.