How do I troubleshoot Lambda "permission denied" or "unable to import module" errors when uploading a deployment package?

Last updated: 2019-04-10

I uploaded my AWS Lambda deployment package file and got an error. What's wrong, and how do I fix it?

Short Description

Issues with incorrect permissions are common for packages generated by continuous integration applications. If the security permissions set for your Lambda deployment package .zip or .jar file are incorrect, you get an error when you try to upload the file. Lambda requires global read permissions on code files and any dependent libraries in your deployment package.

Note: Lambda uses POSIX permissions, so we recommend using a POSIX-compliant operating system (for example, Linux, Unix, or macOS) when building Lambda deployment packages. Parity between the permissions model in your build environment and execution environment reduces the chance of permissions issues.

If you use Windows for development and need to fix a permissions issue, you can set up a Linux environment by doing either of the following:

Install a Linux distro on your PC (Windows 10 only). For more information, see Windows Subsystem for Linux Installation Guide for Windows 10 on the Microsoft Docs website.
Launch an Amazon Elastic Compute Cloud (Amazon EC2) instance using Lambda's Amazon Machine Image (AMI).

Resolution

Identify the cause of the error

Depending on the language you use to write your Lambda function code, the cause of the error might not be clear from the error message. For example, in a Node.js function, the error is clear:

{
  "errorMessage": "EACCES: permission denied, open '/var/task/index.js'",
  "errorType": "Error",
  "stackTrace": [
    "Object.fs.openSync (fs.js:641:18)",
    "Object.fs.readFileSync (fs.js:509:33)",
    "Object.Module._extensions..js (module.js:578:20)",
    "Module.load (module.js:487:32)",
    "tryModuleLoad (module.js:446:12)",
    "Function.Module._load (module.js:438:3)",
    "Module.require (module.js:497:17)",
    "require (internal/module.js:20:19)"
  ]
}

For a Python function, it can be trickier to identify the error. For example:

Unable to import module 'index': No module named index

Or, if external libraries are missing required permissions:

Unable to import module 'index': No module named exlib

Fix the permissions for your deployment package

Note: These commands are valid only for Linux/Unix/macOS systems.

1. (Optional) Check the permissions of your deployment package file by running zipinfo in the command line interface (CLI). For more information, see Permissions Policies on Lambda Deployment Packages.

2. Run the following command in the CLI to fix the permissions recursively:

$ chmod 644 $(find /tmp/package_contents -type f)$ chmod 755 $(find /tmp/package_contents -type d)

3. After fixing the permissions, upload the deployment package again.

Related Information

Creating a Deployment Package

Did this article help you?

Yes

Anything we could improve?

Let us know

Need more help?

Contact AWS Support