1. Log in to your AWS Management Console.
2. Navigate to the AWS Lambda service from the Services menu.
3. Select the function that has the same IAM role as another function.
4. Scroll down to the “Permissions” section and click on the IAM role name.
5. This will take you to the IAM console. Click on the “Create Role” button.
6. In the “Create Role” wizard, select “AWS service” as the trusted entity and “Lambda” as the service that will use this role.
7. Click on the “Next: Permissions” button.
8. In the “Attach permissions policies” section, select the policies that your function needs to run.
9. Click on the “Next: Tags” button.
10. Add any tags that you want to associate with this role (optional).
11. Click on the “Next: Review” button.
12. Give the role a name and description.
13. Click on the “Create Role” button.
14. Go back to the Lambda function and scroll down to the “Permissions” section.
15. Click on the “Edit” button next to the “Execution role” field.
16. Select the newly created IAM role from the list.
17. Click on the “Save” button.

​

1. Identify the functions that have the same IAM role assigned to them. You can use the following command to list all the functions and their IAM roles:

aws lambda list-functions --query 'Functions[*].[FunctionName, Role]'

2. Once you have identified the functions that have the same IAM role assigned to them, you can create a new IAM role for each function using the following command:

aws iam create-role --role-name <new_role_name> --assume-role-policy-document file://trust-policy.json

3. After creating the new IAM roles, you can update the function configurations to use the new IAM roles using the following command:

aws lambda update-function-configuration --function-name <function_name> --role <new_role_arn>

4. Repeat step 3 for all the functions that have the same IAM role assigned to them.
5. Once all the functions have been updated to use unique IAM roles, you can delete the old shared IAM role using the following command:

aws iam delete-role --role-name <old_role_name>

1. Identify the functions that are sharing the same IAM role. You can use the AWS CLI command aws lambda list-functions to get a list of all the functions in your account and their associated IAM roles.
2. For each function that is sharing the same IAM role with another function, create a new IAM role. You can use the AWS CLI command aws iam create-role to create a new IAM role with the necessary permissions for the function.
3. Update each function to use the new IAM role. You can use the AWS CLI command aws lambda update-function-configuration to update the function’s configuration and specify the new IAM role.

import boto3

# Initialize the AWS clients
lambda_client = boto3.client('lambda')
iam_client = boto3.client('iam')

# Get a list of all the functions in the account
response = lambda_client.list_functions()

# Loop through each function
for function in response['Functions']:
    # Get the function's IAM role
    role_arn = function['Role']
    role_name = role_arn.split('/')[-1]

    # Check if the role is being used by multiple functions
    response = lambda_client.list_functions(
        FunctionVersion='ALL',
        MaxItems=10000
    )
    shared_role_functions = []
    for f in response['Functions']:
        if f['Role'] == role_arn and f['FunctionName'] != function['FunctionName']:
            shared_role_functions.append(f['FunctionName'])

    if shared_role_functions:
        # Create a new IAM role for the function
        new_role_name = f"{function['FunctionName']}-lambda-role"
        response = iam_client.create_role(
            RoleName=new_role_name,
            AssumeRolePolicyDocument='{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Service": "lambda.amazonaws.com"},"Action": "sts:AssumeRole"}]}'
        )

        # Attach the necessary policies to the new IAM role
        policy_arns = ['arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole']
        for policy_arn in policy_arns:
            iam_client.attach_role_policy(
                RoleName=new_role_name,
                PolicyArn=policy_arn
            )

        # Update the function to use the new IAM role
        lambda_client.update_function_configuration(
            FunctionName=function['FunctionName'],
            Role=response['Role']['Arn']
        )

        print(f"Function {function['FunctionName']} now has its own IAM role {new_role_name}")
    else:
        print(f"Function {function['FunctionName']} is not sharing its IAM role with any other function")