Tried to allow lambda to access S3 with S3 resource based policy, why didn't it work?

user_5207832 0
Viewed 414

I, apparently, naively, Tried to allow any lambda access to read from an S3 bucket.

Never mind if this is a good practice, but for the sake of understanding, I applied the resource policy at the bottom to the S3 bucket (buket, permissions tab, bucket policy).

I thought that his will allow any lambda to read from the bucket. but it didn't work. the only thing that did work, was to set the policy of the lambda to allow reading from this bucket.

My question is, what is the meaning of this S3 resource based policy? the ui allows this, so I assume it's something valid. but what? thanks!

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Principal": {
            "Service": "lambda.amazonaws.com"
        },
        "Action": [
            "s3:GetObject*",
            "s3:GetBucket*",
            "s3:List*"
        ],
        "Resource": [
            "arn:aws:s3:::mybucket",
            "arn:aws:s3:::mybucket/*"
        ]
    }
]

}

aws-lambda amazon-web-services amazon-s3
1 Answers

It doesn't work because your function assumes its execution role role.

Thus you have to add the function's role to bucket policy, not the lambda service:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<your-function-execution-role-arn>"
            },
            "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket",
                "arn:aws:s3:::mybucket/*"
            ]
        }
    ]
}
user_2488230
Related