terraform/aws lambda function access denied on s3

Question

Testing AWS instance scheduler with terraform. Code here

Looks like my code is bumming with this error:

Error: error waiting for CloudFormation Stack creation: failed to create CloudFormation stack, rollback requested (ROLLBACK_COMPLETE): ["The following resource(s) failed to create: [Main]. Rollback requested by user." "Your access has been denied by S3, please make sure your request credentials have permission to GetObject for solutions-us-gov-west-1/aws-instance-scheduler/v1.3.1/instance-scheduler.zip. S3 Error Code: AccessDenied. S3 Error Message: Access Denied (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException; Request ID: 731b7c0d-cda9-4f9e-b821-efed4cbced46; Proxy: null)"]

Below is part of the code: IAM policy

"InstanceSchedulerEncryptionKeyAlias": {
    "Type": "AWS::KMS::Alias",
    "Properties": {
        "AliasName": "alias/instance-scheduler-encryption-key",
        "TargetKeyId": {
            "Ref": "InstanceSchedulerEncryptionKey"
        }
    }
},
"SchedulerPolicy": {
    "Type": "AWS::IAM::Policy",
    "Metadata": {
        "cfn_nag": {
            "rules_to_suppress": [
                {
                    "id": "W12",
                    "reason": "All policies have been scoped to be as restrictive as possible. This solution needs to access ec2/rds resources across all regions."
                }
            ]
        }
    },
    "Properties": {
        "PolicyName": "SchedulerPolicy",
        "Roles": [
            {
                "Ref": "SchedulerRole"
            }
        ],
        "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "logs:CreateLogGroup",
                        "logs:CreateLogStream",
                        "logs:PutLogEvents",
                        "logs:PutRetentionPolicy",
                        "logs:*"
                    ],
                    "Resource": [
                        {
                            "Fn::Join": [
                                ":",
                                [
                                    "arn:aws-us-gov:logs:*:*:*",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::AccountId"
                                    },
                                    "log-group",
                                    {
                                        "Ref": "SchedulerLogGroup"
                                    },
                                    "*"
                                ]
                            ]
                        },
                        {
                            "Fn::Join": [
                                ":",
                                [
                                    "arn:aws-us-gov:logs:*:*:*",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::AccountId"
                                    },
                                    "log-group:/aws/lambda/*"
                                ]
                            ]
                        }
                    ]
                },
                {   "Effect": "Allow",
                    "Action": [
                        "s3:*"
                    ],
                    "Resource": [
                        "arn:aws-us-gov:s3:::*"
                    ]
                }, 

IAM role

 "SchedulerRole": {
    "Type": "AWS::IAM::Role",
    "Properties": {
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "lambda.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                },
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "events.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "Path": "/"
    }
},

I am sure it's bumming on either my format in the code or I am missing something in the role or policy on s3. Looking up similar issues here and will appreciate any pointers on my code. I know I am close.

Answer 1

You have an issue with your joins in your SchedulerPolicy. You need to remove the trailing *:*:*.

"Fn::Join": [
":",
[
    "arn:aws-us-gov:logs:*:*:*",
    {
        "Ref": "AWS::Region"
    },
    {
        "Ref": "AWS::AccountId"
    },
    "log-group:/aws/lambda/*"
]
]

With the above join you will end up with a string arn:aws-us-gov:logs:*:*:*:us-east-1:0987654321:log-group:/aws/lambda/* instead of the expected arn:aws-us-gov:logs:us-east-1:0987654321:log-group:/aws/lambda/*

Answer 2

You do not have access to this s3 object, as you are trying to use the code being shared in this issue Is gov-Cloud supported? #11

"S3Key": "aws-instance-scheduler/v1.3.1/instance-scheduler.zip"

The object is not available anymore

$ curl -I https://aws-instance-scheduler.s3.amazonaws.com/v1.3.0/instance-scheduler.zip
HTTP/1.1 403 Forbidden
x-amz-request-id: 2663CDC7E74E1BE8
x-amz-id-2: GsWrKdNtOqqUdqR6wfWJ0pZGPqlhHD17rFvfCsqsQB09V+T3SGAc+V+HCTCIU8mj501Sbn4K7sA=
Content-Type: application/xml
Date: Tue, 16 Feb 2021 21:14:38 GMT
Server: AmazonS3

The error is saying the same.

Your access has been denied by S3, please make sure your request credentials have permission to GetObject for solutions-us-gov-west-1/aws-instance-scheduler/v1.3.1/instance-scheduler.zip.

If you have somehow got the code you and upload to the bucket you can update your function like below:

{
..
        "MyFunction": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": BUCKETNAME,
                    "S3Key": "aws-instance-scheduler/v1.3.1/instance-scheduler.zip"
                }
            }
        }
    }
}