title: AWS Kinesis Firehose Transformation Lambda Permissions
body: <p>I have a Kinesis Firehose instance, which is set up to call a lambda function to transform incoming records. This works fine when I allow the firehose's IAM role full access to lambda, using the AWS-managed <code>AWSLambdaFullAccess</code> policy.</p>
  
  <p>However, it stops working when I restrict the role to a custom policy, only allowing <code>lambda:InvokeFunction</code> on the specific function. It produced an error message of "Access was denied. Ensure that the access policy allows access to the Lambda function."</p>
  
  <p>Reading the <a href="https://docs.aws.amazon.com/en_us/firehose/latest/dev/data-transformation.html" rel="nofollow noreferrer">documentation</a> doesn't shed any light on what permissions are required, and the Access Advisor doesn't seem to give granular enough information to allow me to work out what is required.</p>
  
  <p>Can anyone advise?</p>