title: Access denied error when creating lambda event source mapping with terraform
body: <p>I have an existing DynamoDB table with stream enabled. I am trying to deploy a lambda function and add dynamodb as trigger using Terraform. </p>
  
  <p>I started with restricted permissions and got AccessDenied error with aws_lambda_event_source_mapping. So I finally gave all the permissions on lambda and DynamoDB for that role, just for testing. But I am still getting access denied error. </p>
  
  <blockquote>
    <p>Error creating Lambda event source mapping: AccessDeniedException</p>
  </blockquote>
  
  <p>Lambda function is deployed successfully. I can confirm that stream_arn for dynamodb table is also accurate.</p>
  
  <p>Here is my terraform script:</p>
  
  <pre><code>resource "aws_iam_role" "lambda_name_role" {
      name = "lambda_name_role-test"
  
     assume_role_policy = &lt;&lt;EOF
     {
         Version": "2012-10-17",
        "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Principal": {
             "Service": "lambda.amazonaws.com"
            },
            "Effect": "Allow",
            "Sid": ""
        }
    ]
  }
  EOF
  }
  
  resource "aws_lambda_function" "lambda_function_name" {
    filename      = "./file.zip"
    function_name = "lambda-function-name-test"
    role          = aws_iam_role.lambda_name_role.arn
    handler       = "parse.handler"
  
    source_code_hash = filebase64sha256("./file.zip")
    memory_size      = 512
    timeout          = 10
    runtime          = "nodejs12.x"
  }
  
  resource "aws_iam_policy" "lambda_dynamodb_access" {
    name        = "lambda_dynamodb_access_policy_test"
    path        = "/"
    description = "IAM policy for DynamoDB access from lambda"
  
    policy = &lt;&lt;EOF
  {
      "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect":"Allow",
                  "Action": [
                      "dynamodb:*",
                      "lambda:*"
                  ],
                  "Resource":"*"
              }
          ]
  
  }
  EOF
  }
  
  resource "aws_iam_role_policy_attachment" "lambda_dynamodb_policy_attachment" {
    role       = aws_iam_role.lambda_name_role.name
    policy_arn = aws_iam_policy.lambda_dynamodb_access.arn
  }
  
  resource "aws_iam_role_policy_attachment" "lambda_cloudwatch_policy_attachment" {
    role       = aws_iam_role.aws_iam_role_policy_attachment.name
    policy_arn = var.cloudwatch_policy_arn
  }
  
  resource "aws_lambda_event_source_mapping" "lambda_trigger_dynamodb" {
    event_source_arn  = var.dynamodb_table_stream_arn
    function_name     = aws_lambda_function.lambda_function_name.arn
    starting_position = "LATEST"
  }
  </code></pre>
  
  <p>Thank you for your help.</p>
  
  <hr>
  
  <p>Update:
  I am able to reproduce this error using AWS CLI.</p>
  
  <pre><code>aws lambda create-event-source-mapping --event-source-arn &lt;dynamodb-stream-arn&gt; --function-name &lt;lambda-function-arn&gt; --enabled --starting-position LATEST
  </code></pre>
  
  <p>Received AccessDeniedException.</p>
  
  <pre><code>An error occurred (AccessDeniedException) when calling the CreateEventSourceMapping operation: User: &lt;my-arn&gt; is not authorized to perform: lambda:CreateEventSourceMapping on resource: * with an explicit deny
  </code></pre>
  
  <p>But I am able to add this mapping from AWS Console.</p>