How can I access S3 bucket objects using Signed Url from a lambda

Question

Hi,
When I store a **permanent IAM key with S3 access on the lambda**, I can successfully access bucket objects.

However when I try to attach a role to the lambda with the required permissions, and the below code in my application, I get 403 errors in the frontend:

```
const s3Client = new S3({
    credentials: {
      accessKeyId: process.env.AWS_ACCESS_KEY_ID,
      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
      sessionToken: process.env.AWS_SESSION_TOKEN,
    },
    signatureVersion: 'v4',
    region: CI ? process.env.AWS_REGION : process.env.AWS_REGION_LAMBDA,
  })
```

I am generating signed urls for upload and download, and everything is working fine with the permanent IAM key, just not with the Lambda role (As is recommended by AWS current guidelines).

Answer

The credentials that the Lambda function is operating with are relatively short-lived - they may expire by the time the presigned URL is used. Hence it is better in this case to have long-lived credentials which are used for creating the URL - as you are doing now.

How can I access S3 bucket objects using Signed Url from a lambda

Relevant content