AWS lambda not able to access cross account s3 bucket object but from cli its working

Question

I am getting forbidden error while accessing cross-account s3 buckets, but I am able to access bucket using aws s3 cli.

I have checked the following things:

1. I have tested code in June and was working and not changed in the last 4 months.
2. Lambda role (not changed in the last 4 months):

        {
            "Action": "s3:*",
            "Resource": [
                "*"
            ],
            "Effect": "Allow"
        },

3. code is working with s3 bucket in the same account.
4. in account 2 all list objects, write objects, Read bucket permissions, and Write bucket permissions access is given.

I am able to list bucket contents from aws cli and it's not working with lambda.

Answer 1

Found out the issue, it was happening because I didn't apply object level acl to read object

But still, there is one issue that there can be multiple files for whom I want the head object to determine the size of the file and asking the customer to put object acl one by one on each object is not user friendly so is there a way to put read object acl on bucket level.

Answer 2

Scenario:

• Lambda-A in Account-A
• Bucket-B in Account-B
• Lambda-A wants to access objects in Bucket-B

To do this, two things are required:

Lambda-A must have an IAM Role with Amazon S3 permissions to access the remote bucket (eg similar to Role you show in your question). However, be careful, the role you show grants TOTAL S3 permissions, including deleting objects and deleting buckets! You should always scope-down the necessary permissions for that the Lambda function requires.

Also, Account-B must permit access to the Lambda function, since it owns the bucket. This can accomplished in two ways:

• Add a Bucket Policy to Bucket-B that grants access to the IAM Role being used by the Lambda function, or
• The Lambda function can assume an IAM Role in Account-B that has been granted access to Bucket-B

Your method of granting access by making individual objects public is not a great way of granting access.