For code running in Lambda to access S3, the execution role is the caller-side permission and the bucket policy is a resource-side control. In the same account, an applicable allow can come from either policy type, unless another control blocks the request. For cross-account access, both the Lambda caller’s account and the bucket-owning account generally must allow it. An explicit deny always overrides an applicable allow.
What each policy controls
S3 bucket policy: permissions on the resource
A bucket policy is attached to an S3 bucket. It can allow or deny specified principals to perform specified S3 actions on bucket or object resources, with conditions that further limit when access applies. The bucket owner attaches the policy. See AWS’s bucket policy documentation.
As an Amazon Associate I earn from qualifying purchases.
A bucket policy is not a blanket permission for every object in the bucket: it does not apply to objects owned by a different AWS account. AWS says S3 Object Ownership defaults to Bucket owner enforced, which disables ACLs; ownership settings therefore matter when diagnosing access to objects. The details are in AWS’s bucket policy guidance.
Lambda execution role: permissions for the function’s code
Each Lambda function has an execution role that the service assumes while the function runs. Policies attached to that role describe what the code can do with other AWS resources. If the function reads or writes S3, its role needs the permission for the relevant S3 action and resource. Lambda’s permissions documentation explains execution roles and their use.
#1 Best Overall
Logging is a separate permission need: Lambda’s default CloudWatch Logs logging requires permissions, commonly supplied by the AWS-managed AWSLambdaBasicExecutionRole policy. That policy does not, by itself, provide the S3 permissions needed by the function.
How the two policies work together
For a request within one account, AWS evaluates applicable identity-based and resource-based policies together. An applicable allow is needed, and an explicit deny overrides an allow. That does not mean every same-account request must be independently allowed by both the role policy and the bucket policy: depending on the request and applicable controls, permission can come from an identity-based or resource-based policy. AWS describes this model in its guide to identity-based and resource-based policies.
For cross-account access, the caller’s account must allow the request and the account that owns the resource must also allow it. A bucket policy naming an external account or role is therefore only the resource-side part of the grant; the Lambda execution role also needs the appropriate identity-based permission. See AWS’s IAM permissions guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Situation | Check first | Also check |
|---|---|---|
| Lambda code accesses a bucket in the function’s account | The execution role’s permission for the exact S3 action and resource | Bucket-policy restrictions, explicit denies, conditions, or resource-side grants |
| Lambda code accesses a bucket in another account | The execution role’s identity-based permission in the function’s account | The bucket policy in the owner’s account; both accounts must allow cross-account use |
| S3 is expected to invoke a Lambda function | The Lambda function’s resource-based policy allowing the S3 service principal | The S3 event notification configuration and applicable conditions |
| An S3 request returns AccessDenied | The exact API operation, required action, bucket or object ARN, and policy conditions | Explicit denies, organization controls, permissions boundaries, endpoint policies, encryption-key permissions, and object ownership |
Make sure you have the right request direction
“Lambda accesses S3” means the function’s code makes an S3 API request; the execution role authorizes that request. “S3 invokes Lambda” means the S3 service calls the function; the Lambda function’s resource-based policy authorizes that invocation. One permission path does not replace the other. For the invocation side, see AWS’s guide to granting other AWS entities access to Lambda functions.
Rank #3
Match the S3 permission to the operation and resource
S3 permissions are specific to API operations, and bucket-level and object-level operations use different resource ARN types. For example, a policy that allows an operation on the bucket ARN does not automatically grant an object operation on object ARNs. Identify the API call the function makes, then check the required action and resource type in AWS’s required-permissions reference for S3 API operations.
If the request uses an access point, check the access-point policy as well; supported operations can also require a corresponding permission on the bucket. Do not assume a broad bucket-level permission covers every access path or object operation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why Lambda may get AccessDenied from S3
Start with the actual failed S3 API call rather than adding broad permissions. An error can reflect a missing action, a mismatch between bucket and object ARN, a condition that does not match the request, or a policy that explicitly denies access. Other applicable controls can also matter, including organization policies, permissions boundaries, VPC endpoint policies, and permissions for an encryption key.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Identify the failing operation. Determine which S3 API call fails, then use AWS’s operation-to-permission reference to find its required action and resource type.
- Check the execution role. Confirm that the role assumed by the function allows that action on the specific bucket or object ARN.
- Check resource-side rules. Review the bucket policy for explicit denies, conditions, or restrictions. For cross-account access, confirm the bucket owner’s policy allows the caller as well.
- Check other applicable controls. Look for organization controls, permissions boundaries, endpoint policies, and encryption-key permissions that could block the request.
- Verify object ownership. If the object is owned by another account, the bucket policy does not apply to it; account for ownership and ACL settings in the diagnosis.
This checklist narrows common causes; the precise evaluation depends on the request and the policies and controls in the accounts involved. AWS’s S3 and IAM guide provides additional context for how S3 works with IAM.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
