Lambda access denied.

Question

Hello, 
While using copy object to copy a file from one bucket to another Im getting the following error:
Copy failed: An error occurred (AccessDenied) when calling the CopyObject operation: Access Denied

the source and destination policy are the same (with different bucket names):
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowLambdaAccessToObjects",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::827919750216:role/service-role/HandleGuardDutyFindings-role-w4oojtpl"
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::nfd-scanbacket/*"
        },
        {
            "Sid": "AllowLambdaAccessToBucket",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::827919750216:role/service-role/HandleGuardDutyFindings-role-w4oojtpl"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::nfd-scanbacket"
        }
    ]
}

the Lambda policy is:
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"s3:GetObject",
				"s3:PutObject",
				"s3:DeleteObject",
				"s3:ListBucket"
			],
			"Resource": [
				"arn:aws:s3:::nfd-scanbacket",
				"arn:aws:s3:::nfd-scanbacket/*",
				"arn:aws:s3:::nfd-malware-quarantine-bucket",
				"arn:aws:s3:::nfd-malware-quarantine-bucket/*"
			]
		},
		{
			"Effect": "Allow",
			"Action": "logs:CreateLogGroup",
			"Resource": "arn:aws:logs:eu-central-1:827919750216:*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogStream",
				"logs:PutLogEvents"
			],
			"Resource": [
				"arn:aws:logs:eu-central-1:827919750216:log-group:/aws/lambda/HandleGuardDutyFindings:*"
			]
		}
	]
}

No ACL configured.
Appreciate your help on this matter.
Thanks, Hadar

Dmitry_G · Answer

Make sure that you have `*` added to your S3 resources for GetObject, PutObject, and DeleteObject actions to succeed, e.g. `arn:aws:s3:::nfd-scanbacket/*`, not just `arn:aws:s3:::nfd-scanbacket/`.

See [Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket](https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/) for more details.

re:Post Agent · Answer

The "Access Denied" error you're encountering when using the CopyObject operation could be due to several factors, even though your IAM policies appear to be correctly configured. Here are some potential causes and solutions:

1. **S3 Object Ownership and ACLs**: 
- If your buckets have Object Ownership set to "bucket owner enforced," ACLs are disabled. When copying objects between buckets with this setting, you need to ensure both source and destination buckets use the same setting.
- You mentioned "No ACL configured," but it's worth double-checking the Object Ownership settings on both buckets.

2. **Encryption Issues**:
- If the objects in your source bucket are encrypted using KMS keys (SSE-KMS), your Lambda role needs permissions to both decrypt from the source key and encrypt with the destination key.
- Check if your buckets use default encryption with KMS keys and ensure your Lambda role has the necessary KMS permissions.

3. **Bucket Policy Restrictions**:
- There might be other bucket policies or account-level restrictions that are overriding your explicit permissions.
- Verify there are no restrictive bucket policies or S3 Block Public Access settings that might be affecting the operation.

4. **VPC Configuration**:
- If your Lambda function runs in a VPC, ensure it has proper network access to reach S3 through VPC endpoints or NAT gateways.

5. **Cross-Account Access**:
- If the buckets are in different AWS accounts, additional permissions might be needed.

To troubleshoot:
- Try using s3_client.get_object() on the source and s3_client.put_object() on the destination separately to narrow down where the permission issue lies.
- Check CloudTrail logs for more detailed information about the denied access.
- Verify that both buckets' Object Ownership settings are compatible for the copy operation.
- If using KMS encryption, add the necessary KMS permissions to your Lambda role.  
**Sources**  
[Access Denied when copying S3 objects with boto3 even using admin permissions | AWS re:Post](https://repost.aws/questions/QU3cITGClqQX69iLIh4bpafA/access-denied-when-copying-s3-objects-with-boto3-even-using-admin-permissions)  
[Copying, moving, and renaming objects - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/copy-object.html)

Shahed Kazi (@shajam) · Answer

Also, make sure the Lambda and S3 bucket are in the same region. If different region, Lambda won't be able to use the S3 code.

Lambda access denied.

Add your answer

Relevant content