| iam:PassRole | Admin |
| lambda:AddLayerVersionPermission | Admin |
| lambda:AddPermission | Admin |
| lambda:CreateAlias | Admin |
| lambda:CreateCodeSigningConfig | Admin |
| lambda:CreateFunction | Admin |
| lambda:DeleteAlias | Admin |
| lambda:DeleteCodeSigningConfig | Admin |
| lambda:DeleteFunction | Admin |
| lambda:DeleteFunction | Admin |
| lambda:DeleteFunctionCodeSigningConfig | Admin |
| lambda:DeleteFunctionConcurrency | Admin |
| lambda:DeleteFunctionEventInvokeConfig | Admin |
| lambda:DeleteLayerVersion | Admin |
| lambda:DeleteProvisionedConcurrencyConfig | Admin |
| lambda:DisableReplication | Admin |
| lambda:EnableReplication | Admin |
| lambda:PublishLayerVersion | Admin |
| lambda:PublishVersion | Admin |
| lambda:PutFunctionCodeSigningConfig | Admin |
| lambda:PutFunctionConcurrency | Admin |
| lambda:PutFunctionEventInvokeConfig | Admin |
| lambda:PutProvisionedConcurrencyConfig | Admin |
| lambda:RemoveLayerVersionPermission | Admin |
| lambda:UpdateCodeSigningConfig | Admin |
| lambda:UpdateFunctionCode | Admin |
| lambda:UpdateFunctionCodeSigningConfig | Admin |
| lambda:UpdateFunctionConfiguration | Admin |
| lambda:UpdateFunctionEventInvokeConfig | Admin |
| lambda:UpdateFunctionUrlConfig | Admin |
| lambda:CreateEventSourceMapping | Operator |
| lambda:DeleteEventSourceMapping | Operator |
| lambda:InvokeAsync | Operator |
| lambda:InvokeFunction | Operator |
| lambda:RemovePermission | Operator |
| lambda:TagResource | Operator |
| lambda:UntagResource | Operator |
| lambda:UpdateAlias | Operator |
| lambda:UpdateEventSourceMapping | Operator |
| s3:GetObject | Operator |
| lambda:GetFunction | ReadOnly |
| lambda:GetLayerVersion | ReadOnly |
| iam:ListRoles | Metadata |
| lambda:GetAccountSettings | Metadata |
| lambda:GetAlias | Metadata |
| lambda:GetCodeSigningConfig | Metadata |
| lambda:GetEventSourceMapping | Metadata |
| lambda:GetFunctionCodeSigningConfig | Metadata |
| lambda:GetFunctionConcurrency | Metadata |
| lambda:GetFunctionConfiguration | Metadata |
| lambda:GetFunctionEventInvokeConfig | Metadata |
| lambda:GetLayerVersionByArn | Metadata |
| lambda:GetLayerVersionPolicy | Metadata |
| lambda:GetPolicy | Metadata |
| lambda:GetProvisionedConcurrencyConfig | Metadata |
| lambda:ListAliases | Metadata |
| lambda:ListCodeSigningConfigs | Metadata |
| lambda:ListEventSourceMappings | Metadata |
| lambda:ListFunctionEventInvokeConfigs | Metadata |
| lambda:ListFunctions | Metadata |
| lambda:ListFunctionsByCodeSigningConfig | Metadata |
| lambda:ListLayerVersions | Metadata |
| lambda:ListLayers | Metadata |
| lambda:ListProvisionedConcurrencyConfigs | Metadata |
| lambda:ListTags | Metadata |
| lambda:ListVersionsByFunction | Metadata |
