CODEWITHSUNDEEP
amazon-s3aws-lambdaaws-cli
Bhesh Sejawal
Bhesh Sejawal

Reputation: 628

How to Enable and Configure Event Notifications for an S3 Bucket to trigger Lambda from CLI

I am trying to automate the lambda creating process from AWS CLI

Lambda Function Creating

aws lambda create-function \
--function-name "$FUNCTION_NAME" \  
--runtime "java8" \  
--role "$ROLE_ARN" \
--handler "$HANDLER"\  
--zip-file "fileb://./$FILE_LOC" \ 
--environment $ENVS \
--tags $TAGS \
--vpc-config $VPC_CONFIG

Giving Permission to S3

aws lambda add-permission \
--function-name "$FUNCTION_NAME" \
--principal "s3.amazonaws.com" \
--statement-id "s3-permission-1" \
--action "lambda:InvokeFunction" \
--source-arn "$S3_BUCKET_ARN" \
--source-account "$ACCOUNT_NUMBER"

Enabling Event

NOTIFICATION_CONFIGURATIONS='{"LambdaFunctionConfigurations":[{"Id":"my-lambda-function-s3-event-configuration","LambdaFunctionArn":"$LAMBDA_FUNCTION_ARN","Events":["s3:ObjectCreated:*"],"Filter":{"Key":{"FilterRules":[{"Name":"suffix","Value":".log"},{"Name":"prefix","Value":"log/my-app-name"}]}}}]}'

aws s3api put-bucket-notification-configuration\ 
--bucket "$S3_BUCKET_ARN" \
--notification-configuration "$NOTIFICATION_CONFIGURATIONS"

Enabling event is giving me following error

An error occurred (AccessDenied) when calling the PutBucketNotificationConfiguration operation: Access Denied

Even though I have full access as bellow

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "eZeBoI3Gq6v1wHImT01j",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:List*",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectAclVersion",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads",
                "s3:Get*"
            ],
            "Resource": [
                "S3_BUCKET_ARN/*",
                "S3_BUCKET_ARN"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets",
                "s3:ListObjects"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "lambda:InvokeFunction",
            "Resource": [
                "LAMBDA-FUNCTION-ARN*"
            ]
        }
    ]
}

Upvotes: 3

Views: 6886

Answers (1)

congbaoguier
congbaoguier

Reputation: 1045

From the IAM policy you have posted, I didn't see a permission entry of PutBucketNotification nor a s3:* action so it's expected you are seeing that error.

{
    "Version": "2012-10-17",
    "Statement": [
        ...
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets",
                "s3:ListObjects",
                "s3:PutBucketNotification" # <==== you were missing this
            ],
            "Resource": "arn:aws:s3:::*"
        },
        ...
    ]
}

Upvotes: 2

Related Questions