- Lambda execution role has s3 access to 51 functions including ListBuckets and all other read operations.
- My S3 bucket has a policy to allow access from the lambda role. (and it's in the same account anyway so i dont think this is required).
- I even made the bucket public access just for fun.
Here's the lambda code. I'm not sure why bucket.objects.all() fails to access s3.
import json import boto3 s3 = boto3.resource('s3')
def lambda_handler(event, context): print(event)
message = 'Hello {}!'.format(event['Records'][0]['s3']['bucket']['name'])
print(message)
bucket = s3.Bucket('my-bucketname-demo')
# this works
print(bucket.creation_date)
# this fails on access denied
# Iterates through all the objects, doing the pagination for you. Each obj
# is an ObjectSummary, so it doesn't contain the body. You'll need to call
# get to get the whole body.
for obj in bucket.objects.all():
key = obj.key
body = obj.get()['Body'].read()
print(key)
print(body)
return {
'statusCode': 200,
'body': json.dumps('Hello from Lambda!')
}
Here's the error: [ERROR] ClientError: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied
Lambda Execution Role Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetLifecycleConfiguration",
"s3:GetBucketTagging",
"s3:GetInventoryConfiguration",
"s3:GetObjectVersionTagging",
"s3:ListBucketVersions",
"s3:GetBucketLogging",
"s3:ListBucket",
"s3:GetAccelerateConfiguration",
"s3:GetBucketPolicy",
"s3:GetStorageLensConfigurationTagging",
"s3:GetObjectVersionTorrent",
"s3:GetObjectAcl",
"s3:GetEncryptionConfiguration",
"s3:GetBucketObjectLockConfiguration",
"s3:GetIntelligentTieringConfiguration",
"s3:GetBucketRequestPayment",
"s3:GetAccessPointPolicyStatus",
"s3:GetObjectVersionAcl",
"s3:GetObjectTagging",
"s3:GetMetricsConfiguration",
"s3:GetBucketOwnershipControls",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketPolicyStatus",
"s3:ListBucketMultipartUploads",
"s3:GetObjectRetention",
"s3:GetBucketWebsite",
"s3:GetJobTagging",
"s3:GetBucketVersioning",
"s3:GetBucketAcl",
"s3:GetObjectLegalHold",
"s3:GetBucketNotification",
"s3:GetReplicationConfiguration",
"s3:ListMultipartUploadParts",
"s3:GetObject",
"s3:GetStorageLensConfiguration",
"s3:GetObjectTorrent",
"s3:DescribeJob",
"s3:GetBucketCORS",
"s3:GetAnalyticsConfiguration",
"s3:GetObjectVersionForReplication",
"s3:GetBucketLocation",
"s3:GetAccessPointPolicy",
"s3:GetObjectVersion",
"s3:GetStorageLensDashboard"
],
"Resource": "arn:aws:s3:::my-bucket-demo/*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:ListStorageLensConfigurations",
"s3:GetAccessPoint",
"s3:GetAccountPublicAccessBlock",
"s3:ListAllMyBuckets",
"s3:ListAccessPoints",
"s3:ListJobs",
"s3:ListObjects"
],
"Resource": "*"
}
]
}