title: Why can't I put wildcard to invoke a lambda function in IAM policy?
body: <p>I need to invoke a lambda (lambdaB) from another lambda (lambdaA). In lambdaA's IAM policy, I have below configuration:</p>
  <pre><code>{
              &quot;Action&quot;: [
                  &quot;lambda:invokeFunction&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:lambda:ap-southeast-2:264100014405:function:handler:*&quot;
              ],
              &quot;Effect&quot;: &quot;Allow&quot;
          }
  </code></pre>
  <p>It doesn't work and I got below error in lambdaA:</p>
  <p>lambdaA is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:ap-southeast-2:264100014405:handler because no identity-based policy allows the lambda:InvokeFunction action.</p>
  <p>But if I remove the wildcard from the resource:</p>
  <pre><code>&quot;Resource&quot;: [
                  &quot;arn:aws:lambda:ap-southeast-2:264100014405:function:handler&quot;
              ],
  </code></pre>
  <p>it works fine.</p>
  <p>lambdaA calls aws-sdk to invoke the lambda with the lambda name which is <code>handler</code>.</p>
  <p>The reason I put a wildcard is that I'd like to grant lambdaA permission to invoke all alias on lambdaB in the future. What is the right IAM policy I should set in lambdaA's role?</p>