Lamba write to s3 not working unless with FullAccess iam role

Question

I have a lambda function which is supposed to write files on s3 to a folder in a bucket

I set this IAM role to the lambda function:

```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": "s3:PutObject",
			"Resource": "arn:aws:s3:::uploads/images/*"
		}
	]
}
```
So it should be allowed to write to the "uploads" bucket, into the "Images" folder, right?
But it won't work, meaning the image is not written on s3.

However, if I add "AmazonS3FullAccess" which is the AWS given policy, it works.

So the question is, what does S3FullAccess have that my restricted policy doesn't?

柴田晃 · Answer

If you know the error message, could you share it with us?

I guess that you have S3 ACLs enabled.
If S3 ACLs are enabled, `s3:PutObjectAcl` is required.

myronix88 · Answer

Check if you are not using custom KMS key, also error message would be helpful. You can also try with this policy:

```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"s3:PutObject",
				"s3:ListBucket"
			],
			"Resource": [
				"arn:aws:s3:::uploads/images/*",
				"arn:aws:s3:::uploads"
			]
		}
	]
}
```

Lamba write to s3 not working unless with FullAccess iam role

Add your answer

Relevant content