AWS SAM Template: How to Properly Define Inline IAM Policies

AWS Serverless Application Model (SAM) is a powerful framework for defining serverless resources like Lambda functions. One commonly misunderstood part of SAM templates is the Policies section under AWS::Serverless::Function.

I used to write YAML files without ever including the Version field, so I habitually left it out in the Policies section as well — this caused unexpected error when deploying, and it took me quite a while to figure out what was wrong and fix the problem.

Incorrect: Using Only "- Statement:"

Policies:
  - Statement:
      - Effect: Allow
        Action:
          - transcribe:GetMedicalTranscriptionJob
        Resource: "*"

This will result in errors like:

Invalid ARN: Could not be parsed!
Template format error: Every policy must contain a Version field

Correct: Include Full Policy Document

Policies:
  - Version: '2012-10-17'
    Statement:
      - Effect: Allow
        Action:
          - transcribe:GetMedicalTranscriptionJob
        Resource: "*"

IAM policies always require a complete structure with a Version and a Statement array:

{
  "Version": "2012-10-17",
  "Statement": [ ... ]
}

Since AWS SAM directly expects this structure, omitting the Version will cause deployment errors.

Why 'Version' Is Required in SAM Inline Policies

• The AWS SAM Developer Guide does not contain an explicit statement such as "When defining an inline policy in the Policies section, you must include Version: '2012-10-17'."
• However, since the expected input for the Policies property is a standard IAM policy document, which includes the Version: '2012-10-17' field, it is reasonable to infer that including this field is the correct approach.