title: terraform/aws lambda function access denied on s3
body: <p>Testing AWS instance scheduler with terraform. Code <a href="https://github.com/Vinod1908/TestTerraform/blob/master/instanceScheduler.tf" rel="nofollow noreferrer">here</a></p>
  <p>Looks like my code is bumming with this error:</p>
  <blockquote>
  <p>Error: error waiting for CloudFormation Stack creation: failed to create CloudFormation stack, rollback requested (ROLLBACK_COMPLETE): [&quot;The following resource(s) failed to create: [Main]. Rollback requested by user.&quot; &quot;Your access has been denied by S3, please make sure your request credentials have permission to GetObject for solutions-us-gov-west-1/aws-instance-scheduler/v1.3.1/instance-scheduler.zip. S3 Error Code: AccessDenied. S3 Error Message: Access Denied (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException; Request ID: 731b7c0d-cda9-4f9e-b821-efed4cbced46; Proxy: null)&quot;]</p>
  </blockquote>
  <p>Below is part of the code: <code>IAM policy</code></p>
  <pre class="lang-json prettyprint-override"><code>&quot;InstanceSchedulerEncryptionKeyAlias&quot;: {
      &quot;Type&quot;: &quot;AWS::KMS::Alias&quot;,
      &quot;Properties&quot;: {
          &quot;AliasName&quot;: &quot;alias/instance-scheduler-encryption-key&quot;,
          &quot;TargetKeyId&quot;: {
              &quot;Ref&quot;: &quot;InstanceSchedulerEncryptionKey&quot;
          }
      }
  },
  &quot;SchedulerPolicy&quot;: {
      &quot;Type&quot;: &quot;AWS::IAM::Policy&quot;,
      &quot;Metadata&quot;: {
          &quot;cfn_nag&quot;: {
              &quot;rules_to_suppress&quot;: [
                  {
                      &quot;id&quot;: &quot;W12&quot;,
                      &quot;reason&quot;: &quot;All policies have been scoped to be as restrictive as possible. This solution needs to access ec2/rds resources across all regions.&quot;
                  }
              ]
          }
      },
      &quot;Properties&quot;: {
          &quot;PolicyName&quot;: &quot;SchedulerPolicy&quot;,
          &quot;Roles&quot;: [
              {
                  &quot;Ref&quot;: &quot;SchedulerRole&quot;
              }
          ],
          &quot;PolicyDocument&quot;: {
              &quot;Version&quot;: &quot;2012-10-17&quot;,
              &quot;Statement&quot;: [
                  {
                      &quot;Effect&quot;: &quot;Allow&quot;,
                      &quot;Action&quot;: [
                          &quot;logs:CreateLogGroup&quot;,
                          &quot;logs:CreateLogStream&quot;,
                          &quot;logs:PutLogEvents&quot;,
                          &quot;logs:PutRetentionPolicy&quot;,
                          &quot;logs:*&quot;
                      ],
                      &quot;Resource&quot;: [
                          {
                              &quot;Fn::Join&quot;: [
                                  &quot;:&quot;,
                                  [
                                      &quot;arn:aws-us-gov:logs:*:*:*&quot;,
                                      {
                                          &quot;Ref&quot;: &quot;AWS::Region&quot;
                                      },
                                      {
                                          &quot;Ref&quot;: &quot;AWS::AccountId&quot;
                                      },
                                      &quot;log-group&quot;,
                                      {
                                          &quot;Ref&quot;: &quot;SchedulerLogGroup&quot;
                                      },
                                      &quot;*&quot;
                                  ]
                              ]
                          },
                          {
                              &quot;Fn::Join&quot;: [
                                  &quot;:&quot;,
                                  [
                                      &quot;arn:aws-us-gov:logs:*:*:*&quot;,
                                      {
                                          &quot;Ref&quot;: &quot;AWS::Region&quot;
                                      },
                                      {
                                          &quot;Ref&quot;: &quot;AWS::AccountId&quot;
                                      },
                                      &quot;log-group:/aws/lambda/*&quot;
                                  ]
                              ]
                          }
                      ]
                  },
                  {   &quot;Effect&quot;: &quot;Allow&quot;,
                      &quot;Action&quot;: [
                          &quot;s3:*&quot;
                      ],
                      &quot;Resource&quot;: [
                          &quot;arn:aws-us-gov:s3:::*&quot;
                      ]
                  }, 
  </code></pre>
  <p>IAM role</p>
  <pre class="lang-json prettyprint-override"><code> &quot;SchedulerRole&quot;: {
      &quot;Type&quot;: &quot;AWS::IAM::Role&quot;,
      &quot;Properties&quot;: {
          &quot;AssumeRolePolicyDocument&quot;: {
              &quot;Version&quot;: &quot;2012-10-17&quot;,
              &quot;Statement&quot;: [
                  {
                      &quot;Effect&quot;: &quot;Allow&quot;,
                      &quot;Principal&quot;: {
                          &quot;Service&quot;: &quot;lambda.amazonaws.com&quot;
                      },
                      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
                  },
                  {
                      &quot;Effect&quot;: &quot;Allow&quot;,
                      &quot;Principal&quot;: {
                          &quot;Service&quot;: &quot;events.amazonaws.com&quot;
                      },
                      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
                  }
              ]
          },
          &quot;Path&quot;: &quot;/&quot;
      }
  },
  </code></pre>
  <p>I am sure it's bumming on either my format in the code or I am missing something in the role or policy on s3. Looking up similar issues here and will appreciate any pointers on my code. I know I am close.</p>