# Lambda adds full IAM resource-based policy support > Lambda expands resource policies to support multiple principals, actions, and IAM conditions, giving platform teams a broader policy surface to review. Canonical URL: https://www.devobs.io/news/news-aws-lambda-full-resource-policies/ By: Jonah Reed Published: 2026-09-06T11:58:54.635Z Updated: 2026-09-06T11:58:54.635Z Event date: 2026-08-25 Section: Security AWS expanded Lambda's resource-based policies on August 25, adding support for full IAM policy documents with multiple principals, actions, and condition keys. ## A broader policy document The [announcement](https://aws.amazon.com/about-aws/whats-new/2026/08/aws-lambda-full-iam-resource-based-policies/) describes replacing individual permission additions with a more expressive policy-management option. AWS highlights conditions such as source IP and principal tags and lists console, CLI, SDK, and infrastructure-as-code update paths. For a platform team managing many functions or accounts, the release creates an opportunity to express a shared permission rule more directly. It also increases the importance of understanding the full document when reviewing a change. Our analysis: a smaller policy file is not necessarily a narrower grant. Consolidation can make intended patterns clearer, but it can also hide the effect of a wildcard or a condition that applies differently than its author expects. ## Review behavior before consolidating Begin with one existing function and enumerate the callers and operations that should remain allowed. Include negative cases: another account, a caller without the expected tag, and a service request lacking the context a condition expects. Compare the intended decisions before and after the proposed policy replacement. Have the reviewer inspect effective access rather than only the textual difference between the two representations. Coordinate ownership with the systems that already modify function permissions. An infrastructure deployment, an integration setup tool, and a manual administrator should not unknowingly compete to manage the same policy. Keep the previous policy available for rollback and monitor denied requests during the first rollout. The useful result is a policy that is easier to explain and verify, with evidence that consolidation preserved the intended caller boundary. ## Source references -