title: Why does my lambda function get Access Denied trying to access an S3 bucket?
body: <ol>
  <li>Lambda execution role has s3 access to 51 functions including ListBuckets and all other read operations.</li>
  <li>My S3 bucket has a policy to allow access from the lambda role. (and it's in the same account anyway so i dont think this is required).</li>
  <li>I even made the bucket public access just for fun.</li>
  </ol>
  <p>Here's the lambda code. I'm not sure why bucket.objects.all() fails to access s3.</p>
  <p>import json
  import boto3
  s3 = boto3.resource('s3')</p>
  <p>def lambda_handler(event, context):
  print(event)</p>
  <pre><code>message = 'Hello {}!'.format(event['Records'][0]['s3']['bucket']['name'])  
  print(message)
  bucket = s3.Bucket('my-bucketname-demo')
  # this works
  print(bucket.creation_date)
  
  # this fails on access denied
  # Iterates through all the objects, doing the pagination for you. Each obj
  # is an ObjectSummary, so it doesn't contain the body. You'll need to call
  # get to get the whole body.
  for obj in bucket.objects.all():
      key = obj.key
      body = obj.get()['Body'].read()
      print(key)
      print(body)
      
  return {
      'statusCode': 200,
      'body': json.dumps('Hello from Lambda!')
  }
  </code></pre>
  <p>Here's the error:
  [ERROR] ClientError: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied</p>
  <p>Lambda Execution Role Policy</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;s3:GetLifecycleConfiguration&quot;,
                  &quot;s3:GetBucketTagging&quot;,
                  &quot;s3:GetInventoryConfiguration&quot;,
                  &quot;s3:GetObjectVersionTagging&quot;,
                  &quot;s3:ListBucketVersions&quot;,
                  &quot;s3:GetBucketLogging&quot;,
                  &quot;s3:ListBucket&quot;,
                  &quot;s3:GetAccelerateConfiguration&quot;,
                  &quot;s3:GetBucketPolicy&quot;,
                  &quot;s3:GetStorageLensConfigurationTagging&quot;,
                  &quot;s3:GetObjectVersionTorrent&quot;,
                  &quot;s3:GetObjectAcl&quot;,
                  &quot;s3:GetEncryptionConfiguration&quot;,
                  &quot;s3:GetBucketObjectLockConfiguration&quot;,
                  &quot;s3:GetIntelligentTieringConfiguration&quot;,
                  &quot;s3:GetBucketRequestPayment&quot;,
                  &quot;s3:GetAccessPointPolicyStatus&quot;,
                  &quot;s3:GetObjectVersionAcl&quot;,
                  &quot;s3:GetObjectTagging&quot;,
                  &quot;s3:GetMetricsConfiguration&quot;,
                  &quot;s3:GetBucketOwnershipControls&quot;,
                  &quot;s3:GetBucketPublicAccessBlock&quot;,
                  &quot;s3:GetBucketPolicyStatus&quot;,
                  &quot;s3:ListBucketMultipartUploads&quot;,
                  &quot;s3:GetObjectRetention&quot;,
                  &quot;s3:GetBucketWebsite&quot;,
                  &quot;s3:GetJobTagging&quot;,
                  &quot;s3:GetBucketVersioning&quot;,
                  &quot;s3:GetBucketAcl&quot;,
                  &quot;s3:GetObjectLegalHold&quot;,
                  &quot;s3:GetBucketNotification&quot;,
                  &quot;s3:GetReplicationConfiguration&quot;,
                  &quot;s3:ListMultipartUploadParts&quot;,
                  &quot;s3:GetObject&quot;,
                  &quot;s3:GetStorageLensConfiguration&quot;,
                  &quot;s3:GetObjectTorrent&quot;,
                  &quot;s3:DescribeJob&quot;,
                  &quot;s3:GetBucketCORS&quot;,
                  &quot;s3:GetAnalyticsConfiguration&quot;,
                  &quot;s3:GetObjectVersionForReplication&quot;,
                  &quot;s3:GetBucketLocation&quot;,
                  &quot;s3:GetAccessPointPolicy&quot;,
                  &quot;s3:GetObjectVersion&quot;,
                  &quot;s3:GetStorageLensDashboard&quot;
              ],
              &quot;Resource&quot;: &quot;arn:aws:s3:::my-bucket-demo/*&quot;
          },
          {
              &quot;Sid&quot;: &quot;VisualEditor1&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;s3:ListStorageLensConfigurations&quot;,
                  &quot;s3:GetAccessPoint&quot;,
                  &quot;s3:GetAccountPublicAccessBlock&quot;,
                  &quot;s3:ListAllMyBuckets&quot;,
                  &quot;s3:ListAccessPoints&quot;,
                  &quot;s3:ListJobs&quot;,
                  &quot;s3:ListObjects&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>