Question: How do I allow my Lambda function access to my Amazon S3 bucket?

I want my AWS Lambda function to be able to access my Amazon Simple Storage Service (Amazon S3) bucket.

Short descriptionTo give your Lambda function access to an Amazon S3 bucket in the same AWS account, do the following:1.    Create an AWS Identity and Access Management (IAM) role for the Lambda function that also grants access to the S3 bucket.2.    Configure the IAM role as the Lambda functions execution role.3.    Verify that the S3 bucket policy doesn't explicitly deny access to your Lambda function or its execution role.Important: If your S3 bucket and the functions IAM role are in different accounts, then you must also grant the required permissions on the S3 bucket policy. For more information, see How can I provide cross-account access to objects that are in Amazon S3 buckets?ResolutionCreate an IAM role for the Lambda function that also grants access to the S3 bucket1.    Follow the steps in Creating an execution role in the IAM console.2.    From the list of IAM roles, choose the role that you just created.3.    The trust policy must allow Lambda to assume the execution role by adding lambda.amazonaws.com as a trusted service. Choose the Trust relationships tab, choose Edit trust policy, and replace the policy with the following:{  "Version": "2012-10-17",  "Statement": [    {     "Effect": "Allow",     "Principal": {     "Service": "lambda.amazonaws.com"    },  "Action": "sts:AssumeRole"  } ]}4. Choose Update policy.5.    In the Permissions tab, choose Add inline policy.6.    Choose the JSON tab.7.    Enter a resource-based IAM policy that grants access to your S3 bucket. For more information, see Using resource-based policies for AWS Lambda.The following example IAM policy grants access to a specific Amazon S3 bucket with Get permissions. To access the objects inside the Amazon S3 bucket, make sure to specify the correct path or use a wildcard character ("*"). For more information, see Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket for more information.Important: Replace "arn:aws:s3:::EXAMPLE-BUCKET" with your S3 buckets Amazon Resource Name (ARN).{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ExampleStmt",      "Action": [        "s3:GetObject"      ],      "Effect": "Allow",      "Resource": [        "arn:aws:s3:::EXAMPLE-BUCKET/*"      ]    }  ]}6.    Choose Review policy.7.    For Name, enter a name for your policy.8.    Choose Create policy.Configure the IAM role as the Lambda functions execution role1.    Open the Lambda console.2.    Choose your Lambda function.3.    Under Execution role, for Existing role, select the IAM role that you created.4.    Choose Save.Verify that the S3 bucket policy doesn't explicitly deny access to your Lambda function or its execution roleTo review or edit your S3 bucket policy, follow the instructions in Adding a bucket policy by using the Amazon S3 console.Important: If your S3 bucket and the functions IAM role are in different accounts, you must also explicitly grant the required permissions on the S3 bucket policy. For more information, see How can I provide cross-account access to objects that are in Amazon S3-buckets?The following example IAM S3 bucket policy grants a Lambda execution role cross-account access to an S3 bucket.Important: Replace "arn:aws:s3:::EXAMPLE-BUCKET/*" with your S3 buckets ARN. Replace "arn:aws:iam::123456789012:role/ExampleLambdaRoleFor123456789012" with your Lambda execution roles ARN.{  "Id": "ExamplePolicy",  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ExampleStmt",      "Action": [        "s3:GetObject"      ],      "Effect": "Allow",      "Resource": [        "arn:aws:s3:::EXAMPLE-BUCKET/*"      ],      "Principal": {        "AWS": [          "arn:aws:iam::123456789012:role/ExampleLambdaRoleFor123456789012"        ]      }    }  ]}Related informationAWS Policy Generator