How do I troubleshoot Amazon S3 event notifications that didn't invoke my Lambda function?

Resolution

To troubleshoot Amazon S3 event notifications for Lambda functions, complete the following steps to verify your permissions and configuration settings:

1. Open the Amazon S3 console, and then navigate to your bucket.
2. Choose the Properties tab.
3. In Event notifications, select your event notification, and then choose Edit.
4. In General configuration, review the Prefix and Suffix settings.
5. (Optional) If you use a prefix or suffix, then confirm the following:
   The object key in your bucket matches the object key naming guidelines.
   Any special characters are in URL-encoded (percent-encoded) format.
6. In Destination, confirm that the Lambda function's ARN matches a valid function.
7. Choose Save changes.
8. Open the Lambda console, and then choose Functions.
9. In Function name, choose your Lambda function.
10. Choose the Configuration tab, and then choose Permissions.
11. In Resource-based policy statements, choose your policy, and the choose View policy.
12. Make sure that the resource-based policy allows Amazon S3 to invoke the Lambda function:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "s3.amazonaws.com"
          },
          "Action": "lambda:InvokeFunction",
          "Resource": "arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME",
          "Condition": {
            "StringEquals": {
              "AWS:SourceAccount": "ACCOUNT_ID"
            },
            "ArnLike": {
              "AWS:SourceArn": "arn:aws:s3:::BUCKET_NAME"
            }
          }
        }
      ]
    } 

    Note: Replace REGION, ACCOUNT_ID, FUNCTION_NAME, and BUCKET_NAME with your AWS Region, AWS account, function name, and bucket name. The AWS:SourceAccount is the account that owns the bucket and ArnLike is the bucket's ARN.

In the preceding resource-based policy, the Principal s3.amazonaws.com has permission to perform the lambda:InvokeFunction API action on the Resource ARN.

Important: Amazon S3 usually delivers event notifications in seconds but can sometimes take 1 minute or longer. For more information, see Amazon S3 Event Notifications.

Related information

How do I allow my Lambda function access to my Amazon S3 bucket?

Why do I get Access Denied errors when I use a Lambda function to upload files to an Amazon S3 bucket in another AWS account?