How do I troubleshoot Lambda "permission denied" or "unable to import module" errors when uploading a deployment package?

Last updated: 2019-04-10

I uploaded my AWS Lambda deployment package file and got an error. What's wrong, and how do I fix it? 

Short Description

Issues with incorrect permissions are common for packages generated by continuous integration applications. If the security permissions set for your Lambda deployment package .zip or .jar file are incorrect, you get an error when you try to upload the file. Lambda requires global read permissions on code files and any dependent libraries in your deployment package.

Note: Lambda uses POSIX permissions, so we recommend using a POSIX-compliant operating system (for example, Linux, Unix, or macOS) when building Lambda deployment packages. Parity between the permissions model in your build environment and execution environment reduces the chance of permissions issues.

If you use Windows for development and need to fix a permissions issue, you can set up a Linux environment by doing either of the following:

Resolution

Identify the cause of the error

Depending on the language you use to write your Lambda function code, the cause of the error might not be clear from the error message. For example, in a Node.js function, the error is clear:

{
  "errorMessage": "EACCES: permission denied, open '/var/task/index.js'",
  "errorType": "Error",
  "stackTrace": [
    "Object.fs.openSync (fs.js:641:18)",
    "Object.fs.readFileSync (fs.js:509:33)",
    "Object.Module._extensions..js (module.js:578:20)",
    "Module.load (module.js:487:32)",
    "tryModuleLoad (module.js:446:12)",
    "Function.Module._load (module.js:438:3)",
    "Module.require (module.js:497:17)",
    "require (internal/module.js:20:19)"
  ]
}

For a Python function, it can be trickier to identify the error. For example: 

Unable to import module 'index': No module named index

Or, if external libraries are missing required permissions: 

Unable to import module 'index': No module named exlib

Fix the permissions for your deployment package

Note: These commands are valid only for Linux/Unix/macOS systems.

1.    (Optional) Check the permissions of your deployment package file by running zipinfo in the command line interface (CLI). For more information, see Permissions Policies on Lambda Deployment Packages.

2.    Run the following command in the CLI to fix the permissions recursively:

$ chmod 644 $(find /tmp/package_contents -type f)$ chmod 755 $(find /tmp/package_contents -type d)

3.    After fixing the permissions, upload the deployment package again.


Did this article help you?

Anything we could improve?


Need more help?