Serverless Developer Guide
initialization duration, and other details. If your function throws an error, the runtime returns that 
error to the invoker.
To help simplify troubleshooting, the AWS Serverless Application Model CLI (AWS SAM CLI) has 
a command called sam logs which will show you CloudWatch Logs generated by your Lambda 
function.
For example, the following terminal command would show the live tail of logs generated by the
YourLambdaFunctionName Lambda function:
sam logs -n YourLambdaFunctionName --tail
Logging and debugging go hand in hand. Traces of events are available with Amazon X-Ray for 
debugging.
Securing functions
AWS Identity and Access Management (IAM) is the service used to manage access to AWS services. 
Lambda is fully integrated with IAM, allowing you to control precisely what each Lambda function 
can do within the AWS Cloud. There are two important things that deﬁne the scope of permissions 
in Lambda functions:
• resource policy: Deﬁnes which events are authorized to invoke the function.
• execution role policy: Limits what the Lambda function is authorized to do.
Using IAM roles to describe a Lambda function’s permissions, decouples security conﬁguration 
from the code. This helps reduce the complexity of a lambda function, making it easier to maintain.
A Lambda function’s resource and execution policy should be granted the minimum required 
permissions for the function to perform it’s task eﬀectively. This is sometimes referred to as the 
rule of least privilege. As you develop a Lambda function, you expand the scope of this policy to 
allow access to other resources as required.
Fundamentals 56