AWS Lambda - Access Denied Error - GetObject

Question

I am a newbie to AWS Lambda. I am trying out the Tutorial from https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example.html. When the user uploads a jpg to a S3 bucket called greetingsproject, the lambda function is triggered.

Error: 9a62ff86-3e24-491d-852e-ded2e2cf5d94
INFO: error while getting object = AccessDenied: Access Denied

I am getting the Access denied error in the following code snippet:

try {
        console.log("srcBucket=" + srcBucket);
        console.log("srcKey=" + srcKey);
        const params = {
            Bucket: srcBucket,
            Key: srcKey
        };
        var origimage = await s3.getObject(params).promise();

    } catch (error) {
        console.log("error while getting object = " + error);
        return;
    }

My Policy for the Role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:PutLogEvents",
                "logs:CreateLogGroup",
                "logs:CreateLogStream"
            ],
            "Resource": "arn:aws:logs:*:*:*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::greetingsproject"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::greetingsproject",
                "arn:aws:s3:::greetingsproject/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::greetingsproject",
                "arn:aws:s3:::greetingsproject/*"
            ]
        }
    ]
}

Not sure what other permissions I need to add to the policy.

Are the lambda function and the s3 bucket in the same aws account? — ORP

DavidC DavidC · Accepted Answer · 2021-04-01T03:16:00

The comment by Marcin about Lambda execution role put me on the right track. I had followed the below steps previously:

Created a policy called greetingsProjectPolicy (with the above mentioned permissions)
Attached this policy to greetingsProjectRole.
Assigned the greetingsProjectRole to my lambda function.
I assumed that was it and the policy should be available to my lambda function.
However when I assigned the greetingsProjectRole to the function, internally AWS created a Execution role called greetingsProject-role-zhcbt61o.
When I clicked on this role, I was surprised to see that only role it had was the AWSLambdaBasicExecutionRole and the greetingsProjectPolicy was missing.
I had to add the greetingsProjectPolicy as a inline policy to greetingsProject-role-zhcbt61o. Now I no longer get the access denied error.

Not sure, if this is how AWS works or I am missing something.

AWS Lambda - Access Denied Error - GetObject

1 Answers