SAM Doctor

ERROR REFERENCE

The Lambda execution role cannot create VPC network interfaces

Lambda is creating or updating a function with a VPC configuration, but the function's execution role cannot create the elastic network interfaces Lambda uses for that attachment. This is the function role, not the role running sam deploy or CloudFormation.

WHAT IT MEANS

The exact failure signal

MyFunction CREATE_FAILED: Resource handler returned message: "The provided execution role does not have permissions to call CreateNetworkInterface on EC2 (Service: Lambda, Status Code: 400, Error Code: InvalidParameterValueException)"

A VPC-connected Lambda function needs an execution role that can create and manage the Hyperplane elastic network interfaces used for the VPC connection. The message is already specific about the missing role capability; changing the CloudFormation deployer's policy is the wrong layer.

NEXT CHECK

Check the function role, then keep the grant narrow

  1. Confirm the VPC attachment. Find the function's VpcConfig and resolve the exact execution-role ARN in the transformed template or stack events. Do not start with the role that runs the deployment command.
  2. Read the role's policies. The role needs ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, ec2:DescribeSubnets, ec2:DeleteNetworkInterface, ec2:AssignPrivateIpAddresses, and ec2:UnassignPrivateIpAddresses. Keep the scope and conditions aligned with the Lambda VPC design.
  3. Use the managed policy only when it fits. AWSLambdaVPCAccessExecutionRole includes the required ENI permissions. If you use a custom policy, compare it with the current AWS list instead of copying a broad administrator policy.
  4. Account for propagation. When the role policy is created in the same stack, preserve the dependency and allow IAM propagation before retrying. Once the role is effective, redeploy and treat any new subnet, security-group, or quota message as a separate failure.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes the exact Lambda VPC execution-role marker (high confidence) and keeps it separate from the deployer's generic IAM denials and from lower-level EC2 network-interface capacity failures. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED