Can't Complete AWS SimuLearn: Permissions for a Serverless Application Lab

Question

Hi All:

I'm trying set policies so that S3, Lambda, and functions can run test code and upload the lab text file into S3. It appears I'm almost there but the S3 policy (most likely) or the function isn't configured correctly. I'm following the poorly worded instructions to configure ARNs, bucket names, etc., but no luck.

I'm including lab screenshots, the base JSON and code, and my configured JSON and code. The code is supposed to validate the lab by uploading the text file to S3, by just running "Test" within Lambda > Functions > diy_function.

The S3 policy needs to have the function IAM role ARN added. The code needs the bucket name added. I'm thinking I've done that but, per the error message, something is missing. do I need the function ARN as well as it's IAM role?

Thanks.

Jason

PROVIDED JSON and CODE
################ S3 BUCKET POLICY ################

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:PrincipalArn": "arn:aws:iam:::role/LabLambdaRole"
                }
            }
        }
    ]
}

################ LAMBDA FUNCTION ################

import os
import boto3
import uuid
s3 = boto3.resource('s3')
dynamodb = boto3.resource('dynamodb')
def lambda_handler(event, context):
   message = "Hello from AWS Lambda!"
   encoded_string = message.encode("utf-8")
   file_name = "hello.txt"
   s3_path = "test/" + file_name
   dynamodb.Table(os.environ['DYNAMODB_TABLE_NAME']).put_item(Item={'ID': '12345','content':message})
   s3.Bucket(os.environ['S3_BUCKET_NAME']).put_object(Key=s3_path, Body=encoded_string)
   response = {
      'statusCode': 200,
      'body': 'success!',
      'headers': {
            'Content-Type': 'application/json',
            'Access-Control-Allow-Origin': '*'
      },
   }
   return response

MY JSON
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::lab-bucket-jml-wednesday1/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam:::role/LabLambdaRole",
                       *** "arn:aws:iam::076299723773:role/DIYPermission"***
                    ]
                }
            }

}
    ]
}

MY CODE
import os
import boto3
import uuid
s3 = boto3.resource('s3')

def lambda_handler(event, context):
   message = "DIY message."
   encoded_string = message.encode("utf-8")
   file_name = "diy.txt"
   s3_path = "diy/" + file_name
   s3.Bucket(os.environ['***lab-bucket-jml-wednesday1***']).put_object(Key=s3_path, Body=encoded_string)
   response = {
      'statusCode': 200,
      'body': 'success!',
      'headers': {
            'Content-Type': 'application/json',
            'Access-Control-Allow-Origin': '*'
      },
   }
   return response

![Lab Screenshote](/media/postImages/original/IMK00k5JfLQZObUU9g1GBgzQ)

![Lab Error Message](/media/postImages/original/IMuGm40vh3SDizkAm6eGPwNg)

re:Post Agent · Accepted Answer

I see a few issues with your Lambda function and S3 bucket policy configuration that are causing the errors.

First, let's address the Lambda function code:

1. You're incorrectly referencing the S3 bucket name. In your code, you have:
```
s3.Bucket(os.environ['***lab-bucket-jml-wednesday1***']).put_object(Key=s3_path, Body=encoded_string)
```

This is trying to access an environment variable with the literal name '***lab-bucket-jml-wednesday1***', which doesn't exist. Instead, you should be using:
```
s3.Bucket('lab-bucket-jml-wednesday1').put_object(Key=s3_path, Body=encoded_string)
```
Or set an environment variable named S3_BUCKET_NAME with the value 'lab-bucket-jml-wednesday1' and use:
```
s3.Bucket(os.environ['S3_BUCKET_NAME']).put_object(Key=s3_path, Body=encoded_string)
```

For the S3 bucket policy:

1. Your policy is a "Deny" policy with a condition. This means it will deny all PutObject requests EXCEPT those from the specified IAM roles. This is correct, but make sure the role ARN for your Lambda function is correctly specified.

2. Ensure that the Lambda execution role (DIYPermission) has the necessary IAM permissions to perform s3:PutObject actions on your bucket. You need to attach a policy to the Lambda execution role that allows:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::lab-bucket-jml-wednesday1/*"
]
}
]
}
```

The error message indicates that the Lambda function doesn't have permission to perform the s3:PutObject action, which suggests either:
1. The Lambda execution role doesn't have the necessary IAM permissions, or
2. The bucket policy is incorrectly configured and is denying the request.

Double-check both configurations to ensure your Lambda function has the proper permissions to write to the S3 bucket.  
**Sources**  
[Lambda Access to S3 When Public Access Is Blocked? | AWS re:Post](https://repost.aws/questions/QUzHUiHrtDSvS0Fm1BfD6L1w/lambda-access-to-s3-when-public-access-is-blocked)  
[Securing Amazon S3 presigned URLs for serverless applications | AWS Compute Blog](https://aws.amazon.com/blogs/compute/securing-amazon-s3-presigned-urls-for-serverless-applications/)  
[Unable to perform upload to S3 bucket | AWS re:Post](https://repost.aws/questions/QUEnF30PauREyMCkNRSmTBKg/unable-to-perform-upload-to-s3-bucket)

Can't Complete AWS SimuLearn: Permissions for a Serverless Application Lab

Add your answer

Relevant content