Why Your AWS Lambda Passes CI Tests But Fails in Production With AccessDeniedException

AWS Lambda functions can pass all unit tests and CI checks yet still fail in production when their IAM execution roles lack permissions for newly added SDK calls. This happens because AI coding assistants and static analysis tools only see source code, not the IAM policies attached to the deployed function's role. A tool called Infrawise addresses this gap by scanning code for AWS SDK usage, mapping it to required IAM service permissions, and comparing those against the function's actual attached role policies. It builds a dependency graph linking functions to the AWS resources they touch, then checks whether the execution role's allowed services cover each dependency. The approach aims to surface IAM permission mismatches before deployment rather than at runtime in CloudWatch logs.