Which S3 buckets is Lambda allowed to read code from? There doesn't seem to be any way to define a policy about which S3 buckets Lambda is allowed to run code from.

With most services in AWS, the usual practice is to define an IAM role that can be assumed by the AWS service so that it can perform work on user-created resources in the account. For instance, Kinesis Firehose isn't allowed to write into one of your S3 buckets until it's explicitly granted permission with an IAM role.

Even with Lambda we have the concept of an execution role, that is the IAM role that can be used by custom code in our Lambda. But that still takes place after the code has been loaded.
This represents a misunderstanding of when Lambda code is loaded.

AWS Lambda does not download a copy of the code from S3 every time a function is executed. Instead, Lambda has its own internal storage that is updated when invoking CreateFunction or UpdateFunctionCode either through the API or the Console.

Update with further clarification from jdog:


  Lambda is never given access to S3 buckets -- the user or role that runs CreateFunction is.