## Set up AWS Lambda

URL: https://docs.atlan.com/product/integrations/automation/aws-lambda/how-tos/set-up-aws-lambda

> Learn about set up aws lambda.

:::warning

**🤓 Who can do this?** You will probably need your AWS Lambda administrator to run these commands - you may not have access yourself.

:::

## Create IAM policy

To create an IAM policy with the necessary permissions, follow [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html).

Create the policy using the following JSON:

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "VisualEditor0",
 "Effect": "Allow",
 "Action": [
 "lambda:InvokeFunction",
 "lambda:InvokeAsync"
 "lambda:ListFunctions"
 ],
 "Resource": "*"
 }
 ]
}
```

## Choose authentication mechanism

Using the policy created above, configure one of the following options for authentication.

### User-based authentication

To configure user-based authentication:

1. Create an AWS IAM user by following [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
2. On the _Set permissions_ page, attach the policy created in the previous step to this user.
3. Once the user is created, view or download the user's _access key ID_ and _secret access key_.

 :::warning

 This will be your only opportunity to view or download the access keys. You will not have access to them again after leaving the user creation screen.

 :::

### Role-based authentication

To configure role-based authentication, attach the policy created in the previous step to the EC2 role that Atlan uses for its EC2 instances in the EKS cluster. Please [raise a support ticket](https://docs.atlan.com/support/submit-request) to use this option.

### Role delegation-based authentication

To configure role delegation-based authentication:

1. [Raise a support ticket](https://docs.atlan.com/support/submit-request) to get the ARN of the _Node Instance Role_ for your Atlan EKS cluster.
2. Create a new role in your AWS account by following [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html).
 1. When prompted for policies, attach the policy created in the previous step to this role.
 2. When prompted, create a trust relationship for the role using the following trust policy. (Replace `<atlan_nodeinstance_role_arn>` with the ARN received from Atlan support.) 

 ```json
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "<atlan_nodeinstance_role_arn>"
 },
 "Action": "sts:AssumeRole",
 "Condition": {}
 }
 ]
 }
 ```

3. Now, [reach out to Atlan support](https://docs.atlan.com/support/submit-request) with:
 - The name of the role you created above.
 - The ID of the AWS account where the role was created.

:::warning

Wait until the support team confirms the account is allowlisted to assume the role before running the Lambda function.

:::

---