Restricting S3 bucket access to an AWS Lambda function

user_4040244 0
Viewed 3265

I have a file in an S3 bucket for which I would like to restrict access, so that it can only be accessed from within a specific Lambda function. I tried writing a Bucket policy (subbing in my info for region, account, etc.) to accomplish this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1457474835965",
      "Action": "s3:*",
      "Principal": "*",
      "Effect": "Deny",
      "Resource": "arn:aws:s3:::my-bucket/file.txt",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:lambda:region:account:function:FunctionName"
        }
      }
    }
  ]
}

However access to the file was still denied to the Lambda function when it was invoked. How can I accomplish what I am trying to do?

amazon-iam aws-lambda amazon-web-services amazon-s3
3 Answers
{
    "Version": "2012-10-17",
    "Id": "Policy1592828725895",
    "Statement": [
        {
            "Sid": "ListRelevantDirectories20150907",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::123456789999:role/LamdaRole",
                    "arn:aws:iam::123456789999:root",
                    "arn:aws:iam::123456789999:user/John"
                ]
            },
            "Action": "s3:*",
             "Resource": [
                "arn:aws:s3:::bucket_name",
                "arn:aws:s3:::bucket_name/*"
            ]
        }
    ]
}
user_5746060

You can also try.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1457474835965",
      "Action": "s3:*",
      "Effect": "Allow",
      "Principal": {
         "AWS": "arn:aws:iam::${Id}:role/${lambdaName}-${region}-lambdaRole"
       },
      "Resource": "arn:aws:s3:::my-bucket/file.txt"
    }
  ]
}

The Principal element specifies the user, account, service, or other entity that is allowed or denied access to a resource. Hence Provide the iam role for lambda function in "Principal" object. You can get it from

lambda's console -> Permissions -> Execution Role.

For more info checkout following page: https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-bucket-user-policy-specifying-principal-intro.html

user_42587760
Related