AWS Lambda Error – EACCES: Permission denied

#aws#lambda#devops#cloud

This error occurs occurs when Lambda attempts to read or write outside permissible directories or encounters incorrect file permissions in the deployment package

Problem

Your Lambda function attempts to read or write a file and immediately fails with:

EACCES: permission denied

or in Python:

PermissionError: [Errno 13] Permission denied

The runtime is functioning, but your code is attempting to access a file or directory without the necessary permissions.

• Writing to a read-only directory inside /var/task
• Writing to a non-existent or improperly created directory inside /tmp
• Accessing library files with incorrect permissions in the deployment package

---

Clarifying the Issue

Lambda’s filesystem is mostly read-only, except for the temporary storage location. Your function code runs as a non-root sandbox user (e.g., sbx_user1051), which enforces strict read/write rules:

• /var/task → read-only (your deployed code)
• /var/runtime → read-only (AWS-managed runtime)
• /tmp → read/write, up to the configured ephemeral storage size

Writing anywhere except /tmp will always trigger EACCES. Incorrect file permissions bundled in your deployment package can also cause this error.

• Strict user permissions restrict write operations
• Incorrect chmod flags generate hidden failures
• Bundled libraries may try to write in the wrong location

---

Why It Matters

This error halts your function before business logic can execute. Any workflow involving local file operations requires correct handling of the writable directory.

• Blocks file uploads, transformations, preprocessing
• Breaks local caching for libraries
• Fails silently in warm starts when /tmp fills up

---

Key Terms

• /var/task – Deployed code directory (read-only)
• /tmp – Writable directory for temporary data
• Ephemeral storage – Configurable storage backing /tmp

---

Steps at a Glance

1. Confirm the EACCES/PermissionError in CloudWatch logs.
2. Verify write attempts are using /tmp.
3. Check that /tmp has available storage.
4. Validate file permissions inside the deployment package.
5. Confirm library cache/write behavior.
6. Repackage with corrected permissions.
7. Test the function with manual invocation.
8. Increase ephemeral storage if required.

---

Detailed Steps

Step 1: Confirm the EACCES/PermissionError in CloudWatch logs.

Pull recent logs:

aws logs tail /aws/lambda/my-function --since 5m

Common output:

EACCES: permission denied, open '/var/task/output.json'

This confirms a filesystem permission violation.

---

Step 2: Verify write attempts are using /tmp.

Node.js:

fs.writeFileSync("/tmp/output.json", data)

Python:

with open("/tmp/data.txt", "w") as f:
    f.write("hello")

Any path starting with /var/task must be corrected to /tmp.

---

Step 3: Check that /tmp has available storage.

List available storage:

df -h /tmp

Increase ephemeral storage if low:

aws lambda update-function-configuration \
  --function-name my-function \
  --ephemeral-storage '{"Size": 2048}'

---

Step 4: Validate file permissions inside the deployment package.

Inspect the zip:

unzip -l deploy.zip

Missing read or execute bits can cause hidden permission errors.

---

Step 5: Confirm library cache/write behavior.

Some libraries attempt to create directories or cache files:

• Python’s __pycache__
• Node.js SDK caches
• Image processing libraries

Ensure they point to /tmp.

---

Step 6: Repackage the deployment with corrected permissions.

Reset permissions:

chmod -R 755 .
zip -r ../deploy.zip .

755 ensures directories and any script files are executable and accessible by the Lambda runtime. Missing execute bits can produce EACCES even when paths are correct.

---

Step 7: Test the function again with a controlled invocation.

aws lambda invoke \
  --function-name my-function \
  --payload '{}' \
  out.json

Check logs for lingering permission errors.

---

Step 8: Increase ephemeral storage if required.

If your workflow writes larger files:

aws lambda update-function-configuration \
  --function-name my-function \
  --ephemeral-storage '{"Size": 4096}'

---

Pro Tips

• Only /tmp is writable inside Lambda
• Clean temp files to avoid warm-start accumulation
• Incorrect zip permissions often go unnoticed until runtime

---

Conclusion

EACCES: permission denied occurs when Lambda attempts to read or write outside permissible directories or encounters incorrect file permissions in the deployment package. By ensuring writes target /tmp, resetting file permissions, and verifying ephemeral storage, you can restore stable file operations and eliminate this class of error.

---

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.