Question 19689 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

Permissions on resources defined in cloudformation

I am making a cloudformation template to create a lambda with its permissions.
I need to access a specific s3 bucket and I am placing its specific arn, however when I execute the lambda it tells me that it does not have permission to access that bucket (getObject), but if I put the almost full name of the s3 arn only that I put a * at the end, if it lets me access the files in that bucket.

Bucket name: bucket-test-impl

LambdaSSMPermissions:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: allowSsmS3
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:PutParameters
                  - ssm:PutParameter
                  - s3:GetObject
                Resource:
                  - arn:aws:s3:::bucket-test-* //THIS WORKS
                  - arn:aws:s3:::bucket-test-impl //IT DOESN'T WORK AND IT'S THE ONE I NEED, 
                  - !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/abcd/*/*'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    In the end I was able to remove all references with * using the reading policy that Amazon gives me.

    ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'

    With this, I was able to use the direct arn of the file inside the bucket, without using *

    Resource:
       - arn:aws:s3:::bucket-test-impl

    or:

    Resource:
       - arn:aws:s3:::bucket-test-impl/fileName

  2. 0

    To access s3 bucket you have to provide /* at the end of path.

    change

    arn:aws:s3:::bucket-test-impl

    to

    arn:aws:s3:::bucket-test-impl/*
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search