aws_lambda_permission cost estimation

An aws_lambda_permission adds a statement to a function's resource policy that lets a specific principal invoke it: API Gateway, S3, EventBridge, SNS, another account, and so on. The permission is free. AWS does not charge for the policy statement or for evaluating it. It is pure authorization, the counterpart to an IAM role, and it has no meter.

The cost is entirely downstream, in the invocations the permission unlocks. Once you grant API Gateway permission to invoke a function, every request that reaches the function is billed per invocation and per GB-second, and the API Gateway or event source that triggers it has its own charges too. Granting S3 permission to invoke on every object create means each upload can fire a billed invocation. The permission decides who can generate that billable traffic; the traffic itself is what shows up on the bill.

There is nothing to optimize on the permission. The useful discipline is to scope it tightly (a specific source ARN and account) so only the intended service can drive invocations, which is a security control that also prevents unexpected invocation cost from an unintended trigger. c3x prices the function's invocations and duration, and the event source that calls it, and treats the permission as the free grant it is.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_lambda_permission" "allow_apigw" { statement_id = "AllowAPIGatewayInvoke" action = "lambda:InvokeFunction" function_name = aws_lambda_function.api.function_name principal = "apigateway.amazonaws.com" source_arn = "${aws_api_gateway_rest_api.api.execution_arn}/*/*" }

Pricing dimensions

What you actually pay for when you provision aws_lambda_permission.

Dimension	Unit	What's being charged
Permission grant	free	Adding a resource-policy statement and evaluating it on invoke has no charge. $0
Enabled invocations	per 1M requests + GB-second	Every invocation the permission allows is billed on the function per request and duration. $0.20 per 1M requests
Triggering event source	varies by service	The API Gateway, SNS, or event source granted permission carries its own request charges. API Gateway: ~$1.00 per 1M requests

Optimization tips

Common ways to reduce aws_lambda_permission cost without changing the workload.

Scope the grant to a specific source

Setting source_arn and source_account limits which resource can invoke the function, preventing an unintended trigger from generating billable invocations and tightening security at once.

Remove stale permissions

A permission left behind for a decommissioned trigger is a path for unexpected invocations. Prune statements for sources you no longer use to close off unplanned invocation cost.

Watch high-frequency event sources

Prevents runaway invocation counts

Granting S3 or EventBridge invoke rights on a very frequent event can drive heavy Lambda cost. Confirm the trigger frequency before wiring it, and filter events at the source.

FAQ

Does a Lambda permission cost money?

No. Granting invoke permission is free and has no meter. Cost comes from the invocations it enables, billed on the function per request and GB-second, plus whatever the triggering service charges.

How does a Lambda permission affect my bill?

Indirectly. It decides who can invoke the function, and invocations are billed. Granting a high-frequency source like S3 object creates or EventBridge can unlock heavy invocation cost, so scope and confirm the trigger.

Why does c3x treat a Lambda permission as free?

Because it is pure authorization with no charge. c3x prices the function's invocations and duration and the event source that triggers it, and treats the permission as the zero-cost grant it is.

`aws_lambda_permission` cost estimation