Lambda Access to S3 When Public Access Is Blocked?

Hi. You will need to take a look at the Lambda execution role and also the S3 bucket policy as well. Remember that it's best to practice least privilege when granting access to any AWS resources. There are some common issues to look out for, including does your lambda execution role have the right S3 permissions, is the bucket name correct in your policy, and remember, in your policy you must include both the bucket and the bucket/* in the policy to grant permissions. Here's a sample IAM policy for a lambda role, plus the instructions to create the role and attach it to the lambda execution role:

Sample IAM Policy for your Lambda Role:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action: [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ], "Resource": 'arn:aws:s3:::my-private-bucket/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::my-private-bucket" } ] }

Once you have the policy written the way you need it to be, create the policy:

aws iam create-policy
--policy-name LambdaS3PrivateAccess
--policy-document file://s3-access-policy.json

Next, you will want to make sure that the policy is attached to the Lambda execution role:

aws iam attach-role-policy
--role-name lambda-execution-role
--policy-arn arn:aws:iam:: - add policy arn here-

You can also check the bucket policy for any issues. Just make sure that if you are using a bucket policy the arn of the lambda execution role has access to the permissions needed on the bucket.

Thanks for writing in, and let us know if there's anything else you need!