An S3 bucket event cannot invoke a redaction Lambda because the fun…

Question

An S3 bucket event cannot invoke a redaction Lambda because the function's resource-based policy does not allow the bucket's principal. What should the developer fix?

Accepted Answer

Add an invoke permission on the Lambda resource-based policy (or equivalent event-source permission) that allows the S3 bucket service principal to call the function. — S3 is buzzing the doorbell, but Lambda’s resource policy never listed the bucket as a guest. Add the invoke permission for the S3 principal—don’t rip out IAM or hope weekly email is a trigger.

Answer

Remove the Lambda execution role so the function runs without IAM and can be invoked by anyone.

Answer

Put Deny: in a Lambda environment variable and expect S3 to honor it as a resource policy.

Answer

Replace the S3 event trigger with a weekly manual invoke from the console by operations staff.

An S3 bucket event cannot invoke a redaction Lambda because the function's resource-based policy does not allow the bucket's principal. What should the developer fix?

Short Explanation

Full Explanation