title: CloudFormation script stuck in UPDATE_ROLLBACK_FAILED, AWSLambdaInternal needs GetObject permissions. How to resolve?
body: <p>I have a CloudFormation stack stuck in a state of UPDATE_ROLLBACK_FAILED.</p>
  
  <p>The error message I'm seeing, associated with the creation of a Lambda, is:</p>
  
  <pre><code>Your access has been denied by S3, please make sure your request credentials 
  have permission to GetObject for &lt;codepipeline-bucket-name&gt;/&lt;file-name&gt;]. S3 
  Error Code: AccessDenied. S3 Error Message: Access Denied (Service: 
  AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException; 
  Request ID: &lt;request-id&gt;)
  </code></pre>
  
  <p>I have double checked that the IAM Role associated with the stack has the correct S3 permissions, but I don't think it's CloudFormation that's throwing the permission error. I think it's AWSLambdaInternal service.</p>
  
  <p>I have a dozen other stacks that use the same IAM role and I've not had this problem. I even tried making the specific S3 object public to see if that might be the problem. But I can only assume that AWSLambdaInternal does not have S3 GetObject permission.  I even tried adding sts:AssumeRole permissions for lambda.awsamazon.com to the IAM role the CloudFormation script uses, but that didn't change anything.</p>
  
  <p>The stack was working fine until I decided to move the Lambda function it creates into a VPC.</p>