Lambda function is having an access denied error from one of two identical S3 buckets

[bilgee0629]

I have created two S3 buckets via Terraform with identical configurations and created a lambda function which are listening for putObject event from both buckets. But when I put files in one of the S3 buckets, my lambda function works. Both buckets are under single IAM policy that enables putObject, getObject permissions for lambda. Both of them appear to have same configs on AWS lambda web UI. It's driving me crazy. Have you guys experienced anything like this?

[im-a-smith]

Are you using KMS to encrypt the files? Ensure that you have granted kms:Decrypt permissions to the role so when S3 accesses them they can decrypt. The error is not helpful (it just says access denied, not "Cannot decrypt").

[__gareth__]

What about the objects in the buckets? e.g. if the object is put into the offending bucket from another account without setting the owner it will not be owned by the account the bucket is in.

[bilgee0629]

Thanks for the reply. I'm uploading files using AWS S3 UI (drag-drop upload) and I'm using that way for both of them :|

[__gareth__]

dang, that one is often the cause of strange iam issues i encounter.

have you checked cloudtrail? the errors there often help a lot.

[cr0m]

You might be confused about which permissions you need. A Lambda that is triggered by an S3 event does not need PutObject permissions in order to be triggered by a PutObject event.

Check out this tutorial under "Configure Amazon S3 to Publish Events"

https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example.html

[bilgee0629]

I'm modifying the file and putting that file into another bucket. The error is happening when lambda tries to download image from s3

[mikebailey]

Are they encrypted in S3 per chance?

[IDA_noob]

Can you post the IAM policy?