title: Tagging AWS lambda function access denied
body: <p>I am trying to use aws cli to tag a lambda function. However, I keep getting the access decided error. I even tried to give the user admin access in IAM, and still it does not work. I guess something else has to be configured somewhere that currently overrides the policy</p>
  
  <pre><code>root@fd9f516869e1:~# aws lambda tag-resource --resource $FUNCTION_ARN --tags CURRENT_COMMIT=${CIRCLE_SHA1}
  
  An error occurred (AccessDeniedException) when calling the TagResource operation: User: &lt;user ARN&gt; is not authorized to perform: lambda:TagResource
  </code></pre>
  
  <p>The policy attached to the user is</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "&lt;SID&gt;",
              "Effect": "Allow",
              "Action": [
                  "tag:*",
                  "lambda:ListTags",
                  "lambda:TagResource",
                  "lambda:UntagResource",
                  "lambda:GetFunction",
                  "lambda:UpdateFunctionCode"
              ],
              "Resource": [
                  "&lt;my lambda ARN&gt;"
              ]
          }
      ]
  }
  </code></pre>