How to provide Lambda S3 policy via AWS SAM

Question

I'm trying to provide my Lambda function with the S3FullAccessPolicy policy. Note the target bucket is not configured within the template.yaml - it already exists. Considering the syntax examples from this documentation I have three options:

1.AWS managed policy named:

  Policies:
  - S3FullAccessPolicy

2.AWS SAM policy template (SQSPollerPolicy) defined:

Policies:
  - S3FullAccessPolicy:
      BucketName: abc-bucket-name

3.Or an inline policy document:

  Policies:
  - Statement:
    ...

In trying #1 I get an error that says it seems to suggest I need to provide an arn. If this is the case where would I provide it? The error:

1 validation error detected: Value 'S3FullAccessPolicy' at 'policyArn' failed to satisfy constraint:
 Member must have length greater than or equal to 20

For #2 I provide the bucket name but it says that the policy is 'invalid'. I've tried adding quotes and replacing the name with an arn - but no luck.

And #3 - I can find the code for the policy here but that's in yaml so I wonder if that's even what I'm supposed to be using.

What am I missing here? I'm open to using any one of these options but right now I'm 0/3.

The full Lambda function:

  testFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda/testFunction/
      Handler: app.lambda_handler
      Runtime: python3.8
      Timeout: 900
      Policies:
        - S3FullAccessPolicy

For #2, what exactly was the error?, and what's the problem with using #3? — tianz

dossani dossani · Accepted Answer · 2021-04-16T20:13:30

I used below template without any issues.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31


Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./hello_world/
      Handler: app.lambda_handler
      Runtime: python3.8
      Tracing: Active
      Policies:
        - S3FullAccessPolicy:
            BucketName: existingbucketname # bucket name without arn

Ran it using below command and it deployed successfully.

sam deploy --stack-name sample-stack --s3-bucket bucket-to-deploy --capabilities CAPABILITY_IAM

How to provide Lambda S3 policy via AWS SAM

1 Answers