CloudFormation - Unable to validate destination configuration

Question

I have an old template for an app i am trying to rebuild in AWS with the similar parameters. I have successfully copied all the files to my account and it works fine till it has to create S3 bucket in which it throws the error - Resource handler returned message:

Unable to validate the following destination configurations (Service: S3, Status Code: 400, Request ID: MV9SQ25WK1ZDNA89, Extended Request ID: tvWAt7vhcOeC1MOr07/wokB/CFwY3WJ+Mh38wgnH5oTHuNJc7Eq+kb/3iiJefRiHKnLQVI7zGpfvq9G0YsARmw==)" (RequestToken: 52421cf8-e91e-f57a-54c4-6d90d8382023, HandlerErrorCode: InvalidRequest)

---

I have tried to add permission for lambda functions to my bucket policy as well as my IAM user but still getting stuck with the same error.

My template is stuck at this

  #S3 Bucket
  ParamArchiveBucket:
    Type: AWS::S3::Bucket
    Description: "S3 Bucket to store Param archive videos"
    Properties:
      BucketName: !Sub ${ParamBucketName}-${Environment}
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: "s3:ObjectCreated:*"
            Filter:
              S3Key:
                Rules:
                  - Name: "prefix"
                    Value: !Sub ${paramKey}
            Function: !GetAtt LambdaFunctionArchiveParamSession.Arn

I have tried to add permissions and policies as suggested on AWS help desk and from the net but have still not managed to solve the error. Can someone please help me in understanding the error and solving it.

Answer 1

You need to ensure that the IAM role associated with the Lambda function has the necessary permissions to be invoked by the S3 bucket

Add the following policy to the Lambda function’s execution role:

{
  "Effect": "Allow",
  "Action": "lambda:InvokeFunction",
  "Resource": "arn:aws:lambda:<Region>:<Account-ID>:function:<FunctionName>"
}

Add a AWS::Lambda::Permission resource to explicitly allow the S3 bucket to invoke the Lambda function:

LambdaInvokePermission:
  Type: AWS::Lambda::Permission
  Properties:
    FunctionName: !GetAtt LambdaFunctionArchiveParamSession.Arn
    Action: "lambda:InvokeFunction"
    Principal: "s3.amazonaws.com"
    SourceArn: !Sub "arn:aws:s3:::${ParamBucketName}-${Environment}"