- Newest
- Most votes
- Most comments
The error you're encountering is due to a misunderstanding of how IAM roles and AWS credentials work in the context of Lambda functions running in containers. When you run the Docker container locally and mount your ~/.aws directory, you're providing your local AWS credentials, which includes your profile information. However, when the Lambda function runs in AWS, it doesn't have access to these local credentials.
In AWS Lambda, the function automatically assumes the IAM role you specified when creating the function. This role provides the necessary permissions without needing to explicitly configure AWS credentials or profiles within your code.
The issue arises because your code is trying to use a specific AWS profile ("my-account") which doesn't exist in the Lambda environment. To fix this, you should remove any explicit profile references in your code and let the Lambda service handle the credentials using the assigned IAM role.
Here's how you can modify your code to work correctly:
-
Instead of using a specific profile, create the S3 client without any profile information:
s3 = boto3.client('s3') -
Ensure that the IAM role attached to your Lambda function (AWSLambdaBasicExecutionRole in your case) has the necessary permissions to interact with the S3 bucket. You may need to add specific S3 permissions to this role.
-
Set the S3_BUCKET_NAME as an environment variable for your Lambda function instead of relying on a configuration file.
By making these changes, your Lambda function will use the permissions granted by its IAM role, and you won't need to worry about AWS profiles or credentials within your code.
Remember to rebuild and redeploy your Docker image after making these changes. This approach will work both in the AWS environment and locally if you use the AWS CLI's assume-role feature to simulate the Lambda execution environment.
Sources
Lambda function cannot access S3 bucket, even after granting IAM role/policy | AWS re:Post
Use CreateFunction with an AWS SDK or CLI - AWS Lambda
Use Invoke with an AWS SDK or CLI - AWS Lambda
You are trying to save a file into S3 and for that your function needs to have permissions. The role that you used when you created the function is: AWSLambdaBasicExecutionRole, which does not include permissions to write to S3. You should create a new role for you function, that contains the basic execution role and permissions to write to S3 and use it for your function.
Further more, your should set the environment variables in the Lambda function. I do not see that in your create-function call. Having a .env file that you source locally, does not create variables in Lambda.
Relevant content
asked 3 years ago
asked 4 years ago
asked 3 years ago

boto3.client('s3')dotenv, I don't see any problem doing that.