How to add complementary permissions for queue's worker ?

[piolet]

Description

Hi,

I want use queue construct to build a service which send an email when a message is pushed on queue.
For that, my worker use ses service. But when i try basically, in logs, i can see an error indicate the lambda doesn't have the require permissions for that.
If i add or update manually the role to manage ses:* for every resources (*), it's ok.
But, if i update serverless.yml like documentation about permissions, i don't have the expected result.

How to Reproduce

this my serverless.yml :

service: email-sender
frameworkVersion: '3'

provider:
  name: aws
  runtime: nodejs20.x
  region: eu-west-3
  architecture: arm64
  iam:
    role:
      statements:
        - Effect: Allow
          Action: [ "ses:*" ]
          Resource:
            - ${construct:email-queue.queueArn}
            - "arn:aws:lambda:eu-west-3:*:function:email-sender-*-email-queueWorker"
#
#lift:
#  automaticPermissions: false

constructs:
  email-queue:
    type: queue
    worker:
      handler: src/handler.hello

...

Additional Information

Maybe it will be pretty cool to expose also queue worker arn on build's result ?

[mnapoli]

        - Effect: Allow
          Action: [ "ses:*" ]
          Resource:
            - ${construct:email-queue.queueArn}
            - "arn:aws:lambda:eu-west-3:*:function:email-sender-*-email-queueWorker"

this means "allow Lambda to call SES on the Queue" and (second line) "allow Lambda to call SES on the Function", which doesn't mean anything valid.

The "Resource" should be a SES resource. It's the target of the permission.

The source of the permission will always be the Lambda functions (that's how serverless.yml works).

[piolet]

My bad, I really hadn't understood the roles like that.
With right syntax, it's simply ok

Thank Mathieu