> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/code/integrations/providers/aws-lambda.md).

# AWS Lambda

Connect AWS Lambda to the Code module.

AWS Lambda runs your functions in your own Amazon Web Services (AWS) account. Norbix connects to it with a cross-account role (recommended by Amazon) or with the keys of an IAM user.

{% hint style="warning" %}
You can connect AWS Lambda in Cloud, but Norbix cannot call your functions yet: every test answers *Provider 'AwsLambda' is not wired up yet* (the server has no Lambda client). Connect it now so the settings are ready; nothing is sent to your AWS account. Through the SDK, CLI and API the integration is saved the same way.
{% endhint %}

## Get your credentials

Cloud walks you through these steps and fills in the values for your project. IAM is AWS Identity and Access Management, where users, roles and policies live.

**Cross-Account Role** (recommended — you share no keys):

1. Sign in to the [AWS Management Console](https://console.aws.amazon.com/) and open **IAM → Policies → Create policy → JSON**. Paste the policy Cloud shows in step **01 Create AWS Policy** (it allows `lambda:ListFunctions`, `lambda:GetFunction`, `lambda:InvokeFunction`, `lambda:CreateFunction`, `lambda:UpdateFunctionCode`, `lambda:TagResource`, access to the project's deployment bucket and passing the execution role). Save it as `lambda-codemash-invoke-policy`. AWS guide: [Create IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html).
2. Open **IAM → Roles → Create role**. Choose **AWS account → Another AWS account**, enter the 12-digit account id Cloud shows in step **02**, tick **Require external ID** and enter your Norbix account id (`acc_…`, shown by Cloud), leave **Require MFA** off. Attach `lambda-codemash-invoke-policy` and save the role as `iam-codemash-access-role`. Cloud's **using this link** opens the form already filled. AWS guide: [Access to AWS accounts owned by third parties (external ID)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
3. Open the role and copy its **ARN**, for example `arn:aws:iam::123456789012:role/iam-codemash-access-role`.

**IAM User** (keys):

1. Create the same policy as above.
2. Open **IAM → Users → Create user**, name it `iam-codemash-user-for-lambda` and attach `lambda-codemash-invoke-policy`. AWS guide: [Create an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
3. Open the user → **Security credentials → Create access key**, choose **Third-party service**, and copy the **Access key** and the **Secret access key** (shown once). AWS guide: [Manage access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-key-self-managed.html).

Pick the region your functions live in, for example `eu-central-1` (list: [AWS Lambda endpoints](https://docs.aws.amazon.com/general/latest/gr/lambda-service.html)).

## Connect it in Cloud

**Where:** Code → Integrations → **Add New Integration** → AWS Lambda → **Connect** · `/projects/<project>/code/integrations/new/aws-lambda`

1. Under **How would you like to connect to AWS Lambda?** pick **Cross-Account Role** or **IAM User**, then choose the **AWS Lambda Region**. Step **01 Create AWS Policy** shows the policy with **Copy** and the policy name.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-375b02fb84183c0939a993361831abbd77b5765b%2Faws-lambda-form-1.png?alt=media" alt="New AWS Lambda Integration: the two ways Cross-Account Role and IAM User, the steps 01 Create AWS Policy, 02 Create Cross-Account Role, 03 Connect, and the region eu-central-1"><figcaption><p>Step 01 with the region chosen.</p></figcaption></figure>
2. Press **Next**. For a cross-account role, step **02** lists the values for the new role; for an IAM user it lists the user steps.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-8ab62596a78676cf6743212707b45bcba8ce34af%2Faws-lambda-role-2.png?alt=media" alt="Step 02 Create Cross-Account Role: trusted entity AWS account, the account id, Require external ID with the Norbix account id, attach the policy, role name iam-codemash-access-role"><figcaption><p>Step 02 for a cross-account role.</p></figcaption></figure>

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-c78eaa24c7fbd9a61b5a92564c5292135e8e795d%2Faws-lambda-form-2.png?alt=media" alt="Step 02 Create IAM User: create the user, attach the policy, user name iam-codemash-user-for-lambda, download the credentials"><figcaption><p>Step 02 for an IAM user.</p></figcaption></figure>
3. Press **Next** and fill in step **03 Connect**:

   | Field             | Required                      | What it does                                                | Example                                                   |
   | ----------------- | ----------------------------- | ----------------------------------------------------------- | --------------------------------------------------------- |
   | AWS Lambda Region | yes                           | Where your functions live (step 01).                        | `eu-central-1`                                            |
   | IAM Role ARN      | yes, for a cross-account role | The role Norbix assumes.                                    | `arn:aws:iam::123456789012:role/iam-codemash-access-role` |
   | Access key        | yes, for an IAM user          | The user's access key id.                                   | `AKIAPLACEHOLDERNOTREAL`                                  |
   | Secret access key | yes, for an IAM user          | The user's secret key. Stored encrypted, never shown again. | `placeholder-secret-access-key-not-real`                  |
   | Integration Name  | yes                           | How the integration is listed in Norbix.                    | `Bookshop Lambda`                                         |

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-90b560b59ee336b88808f528a4f8d4a58182c928%2Faws-lambda-role-3.png?alt=media" alt="Step 03 Connect for a cross-account role: IAM Role ARN and Integration Name"><figcaption><p>Step 03 for a cross-account role.</p></figcaption></figure>

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-53acda0ac395fe74adee4d21769fb00472b260b5%2Faws-lambda-form-3.png?alt=media" alt="Step 03 Connect for an IAM user filled with placeholder values: Access key, Secret access key and Integration Name Bookshop Lambda"><figcaption><p>The filled form (made-up placeholder keys).</p></figcaption></figure>
4. Press **Save**. The title becomes *Editing AWS Lambda integration*, the badges say **ENABLED** and **NOT TESTED**, and the id (`int_…`) appears with a copy button. The key fields are empty again with a note that they are not shown.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-e9f67469e432e6c3a39004df376efd980cb48bd7%2Faws-lambda-saved-4.png?alt=media" alt="Editing AWS Lambda integration Bookshop Lambda with the badges ENABLED and NOT TESTED and the id int_6rBACnEaxQ0x1jTiHtAuWV"><figcaption><p>After save.</p></figcaption></figure>

## Test and set as default

**Test integration** answers *Provider 'AwsLambda' is not wired up yet* and sets **TEST FAILED** — see [Test an integration](/codemash/cloud/code/integrations/test.md). **Set as default** is accepted but not kept — see [Set as default](/codemash/cloud/code/integrations/set-default.md). To turn it off: [Disable or delete](/codemash/cloud/code/integrations/disable.md).

From code (the same fields as the form; `integrationType` is `Iam` or `CrossAccountRole`):

```ts
await norbix.hub.code.saveCodeIntegration({
  integration: {
    provider: 'AwsLambda',
    integrationType: 'Iam',
    integrationName: 'Billing Lambda',
    isEnabled: true,
    region: 'eu-central-1',
    accessKey: 'AKIAPLACEHOLDERNOTREAL',
    secretKey: 'placeholder-secret-access-key-not-real',
  },
});
```

```sh
norbix hub code integration save --integration:json '{"provider":"AwsLambda","integrationType":"Iam","integrationName":"Reports Lambda","isEnabled":true,"region":"eu-central-1","accessKey":"AKIAPLACEHOLDERNOTREAL","secretKey":"placeholder-secret-access-key-not-real"}'
```

API: [Save Code Integration](/codemash/api-reference/code/integrations/save-code-integration.md)

## Common errors

| Message                                                             | Cause                                                                             | Fix                                                                       |
| ------------------------------------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| *Required* under **AWS Lambda Region**                              | No region was chosen in step 01.                                                  | Go back to step 01 and pick the region.                                   |
| *Required* under **Secret access key**                              | The secret is empty — it is asked again on every save of an IAM-user integration. | Paste the secret access key again.                                        |
| *Provider 'AwsLambda' is not wired up yet.* on **Test integration** | Norbix has no Lambda client yet.                                                  | Nothing to fix on your side; the test will work when the client is added. |