Wondering how to allow Lambda execution role to access AWS S3 bucket? We can help you.

Here, at Bobcares, we assist our customers with several AWS queries as part of our AWS Support Services.

Today, let us see how our Support Techs perform this task.

How to allow Lambda execution role to access AWS S3 bucket?

Today, let us see the steps followed by our Support Techs in order to perform this task.

To give your Lambda function access to an Amazon S3 bucket in the same AWS account, do the following:

1.Firstly, create an AWS Identity and Access Management (IAM) role for the Lambda function that also grants access to the S3 bucket.

2.Then, configure the IAM role as the Lambda function’s execution role.

3.Finally, verify that the S3 bucket policy doesn’t explicitly deny access to your Lambda function or its execution role.

Create an IAM role for the Lambda function that also grants access to the S3 bucket

1.Firstly, follow the steps in Creating an execution role in the IAM console.

2.From the list of IAM roles, choose the role that you just created.

3.In the Permissions tab, choose Add inline policy.

4.Then, choose the JSON tab.

5.Enter a resource-based IAM policy that grants access to your S3 bucket.

IAM policy example that grants access to a specific S3 bucket

Important: Replace “arn:aws:s3:::AWSDOC-EXAMPLE-BUCKET/*” with your S3 bucket’s Amazon Resource Name (ARN).

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ExampleStmt",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::AWSDOC-EXAMPLE-BUCKET/*"
]
}
]
}

6.Next, choose Review policy.

7.For Name, enter a name for your policy.

8.Finally, choose Create policy.

Configure the IAM role as the Lambda function’s execution role

1.Firstly, open the Lambda console.

2.Then, choose your Lambda function.

3.Under Execution role, for Existing role, select the IAM role that you created.

4.Finally, choose Save.

Verify that the S3 bucket policy doesn’t explicitly deny access to your Lambda function or its execution role

To review or edit your S3 bucket policy, follow the instructions in Adding a bucket policy using the Amazon S3 console.

Important: If your S3 bucket and the function’s IAM role are in different accounts, you must also explicitly grant the required permissions on the S3 bucket policy.

Example IAM S3 bucket policy that grants a Lambda execution role cross-account access to an S3 bucket

Important: Replace “arn:aws:s3:::AWSDOC-EXAMPLE-BUCKET/*” with your S3 bucket’s ARN.

Replace “arn:aws:iam::123456789012:role/ExampleLambdaRoleFor123456789012” with your Lambda execution role’s ARN.

{
"Id": "ExamplePolicy",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ExampleStmt",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::AWSDOC-EXAMPLE-BUCKET/*"
],
"Principal": {
"AWS": [
"arn:aws:iam::123456789012:role/ExampleLambdaRoleFor123456789012"
]
}
}
]
}

[Need help with AWS queries? We’d be happy to assist you]

Conclusion

In short, we saw how our Support Techs Allow Lambda execution role to access AWS S3 bucket.