I might be missing something and could use a 2nd pair of eyes on these policies.
My bucket policy :
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowS3Access",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::redacted:role/myrole"
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::<my-bucket>",
"arn:aws:s3:::<my-bucket>/*"
]
}
]
}
I checked the object permissions and for the only object in there I allow read and write access by everyone just to get this function to work (but it still does not).
Here is the lambda role I am using to access the bucket:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"dynamodb:GetItem",
"s3:ListBucket",
"dynamodb:Query",
"dynamodb:UpdateItem",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:PutObjectAcl"
],
"Resource": [
"arn:aws:s3:::<my-bucket>",
"arn:aws:s3:::<my-bucket>/*",
"arn:aws:dynamodb:us-east-1:dynamo:table/myTable"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"polly:SynthesizeSpeech",
"polly:StartSpeechSynthesisTask",
"s3:ListAllMyBuckets",
"polly:GetSpeechSynthesisTask"
],
"Resource": "*"
}
]
}
Could it be that the function I am writing in lambda is wrong? Here is the part it breaks at:
s3 = boto3.resource('s3')
bucket = s3.Bucket('BUCKET_NAME')
key = postId + "_" + title + ".mp3"
objs = list(bucket.objects.filter(Prefix=key))
if len(objs) > 0 and objs[0].key == key:
print("Exists!")
boto3.client('s3').delete_object(Bucket='BUCKET_NAME', Key=key)
else:
print("Doesn't exist")
I tried adding in ListObject as a policy action but I think it is just related to List bucket. I pulled the list bucket objects function from another answer because I am new at Python, but still seems like it should work at this point.
EDIT: Here is the exact error I receive in cloudwatch
An error occurred (AllAccessDisabled) when calling the ListObjects
operation: All access to this object has been disabled: ClientError
Traceback (most recent call last):
File "/var/task/lambda_function.py", line 33, in lambda_handler
EDIT 2: BUCKET_NAME is an environmental variable.
I was assigning environmental variables incorrectly. The correct syntax is
s3 = boto3.resource('s3', 'us-east-1')
bucket_name = os.environ['BUCKET_NAME'] <<<< this variable
bucket = s3.Bucket(bucket_name) <<<<< into here
to assign environmental variables to your lambda code.