ListObjectV2 Gets Access Denied Error In AWS Lambda

Question

I'm not sure if I get the permissions correct, but I am trying to use listObjectsV2 in my lambda function but I get access denied error. I am using serverless.

Here is my iAMRoleStatement

 iamRoleStatements:
    - Effect: "Allow"
      Action:
        - s3:GetObject
        - s3:ListBucket
      Resource: 
        - "arn:aws:s3:::${self:custom.bucket1}/*"
        - "arn:aws:s3:::${self:custom.bucket2}/*"

It gives me this response:

{
    "errorMessage": "Access Denied",
    "errorType": "AccessDenied",
    "stackTrace": [
        "Request.extractError (/var/runtime/node_modules/aws-sdk/lib/services/s3.js:577:35)",
        "Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20)",
        "Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10)",
        "Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14)",
        "Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)",
        "AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)",
        "/var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10",
        "Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)",
        "Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12)",
        "Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18)"
    ]
}

And here's the function

const AWS = require('aws-sdk')
const apiVersion = '2006-03-01'

module.exports.index = async (event, context) => {
  const s3 = new AWS.S3({ apiVersion })
  const { path: { bucket_name } } = event
  const params = {
    Bucket: 'ml-chips-result'
  }

  return new Promise((resolve, reject) => {
    s3.listObjectsV2(params, (err, data) => {
      if (err) reject(err)
      else resolve(data)
    })
  })
  .then(data => {
    return {
      data,
      event
    }
  })
}

According to examples I found in the docs, the correct permission is ListBuckets. But it doesn't seem to work.

John Rotenstein · Accepted Answer · 2018-11-02 11:30:32Z

8

Try adding permission for ListBuckets to access the root of the bucket too:

  Resource: 
    - "arn:aws:s3:::${self:custom.bucket1}"
    - "arn:aws:s3:::${self:custom.bucket1}/*"
    - "arn:aws:s3:::${self:custom.bucket2}"
    - "arn:aws:s3:::${self:custom.bucket2}/*"

answered Nov 2, 2018 at 11:30

John Rotenstein

273k28 gold badges456 silver badges541 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Franco Over a year ago

Several hours spent into this problem, your answer is way more valuable than the official docs. Thanks !

Collectives™ on Stack Overflow

ListObjectV2 Gets Access Denied Error In AWS Lambda

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related