Add a resource-based policy on the Lambda function granting Amazon S3 permission to invoke it
A company configured an Amazon S3 event source for an AWS Lambda function. The company needs the Lambda function to run when a new object is created or an existing object is modified in a specific S3 bucket. The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the new or modified S3 object. The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table. The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table. During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified. Which solution will resolve these problems?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The function's execution role governs what the code may do once running, not whether S3 may trigger it, so the missing piece is a resource-based policy on the Lambda function naming Amazon S3 as an allowed invoker (B). Option A has the direction reversed: an S3 bucket policy granting the bucket permission to invoke Lambda does not authorize the invocation, because the resource requiring permission is the Lambda function. Options C and D introduce an SQS queue, adding a buffering layer that changes the architecture without addressing the missing invocation permission.
S3 event notifications to Lambda require a resource-based policy on the Lambda function that permits the S3 service to invoke it; without that permission statement the invocation never happens, which is why the function does not run on object creation or modification even though its execution role correctly permits reading the object and writing to DynamoDB. Adding a resource-based policy to the Lambda function allowing Amazon S3 to invoke it on that bucket resolves the problem.
Creating an S3 bucket policy that grants the bucket permission to invoke the Lambda function (A) — the bucket is the caller, not the callee; authorization for a Lambda invocation must be granted on the Lambda function's resource-based policy, so a bucket policy alone cannot authorize it. Adding an SQS queue as an OnFailure destination (C) or routing S3 notifications through SQS (D) — neither addresses the missing resource-based policy; an OnFailure destination only receives failed asynchronous invocations after they have already failed, so it cannot fix a function that never runs in the first place.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
For Amazon S3 to invoke an AWS Lambda function through event notifications, the Lambda function must carry a resource-based policy that explicitly allows the S3 service principal to invoke it, typically scoped with a SourceArn condition to the specific bucket. AWS documentation on Lambda resource-based policies describes exactly this requirement, and in CloudFormation it corresponds to the AWS::Lambda::Permission resource. Since the scenario already confirms the execution role can read from S3 and write to DynamoDB, the only missing element preventing the function from running is that invocation permission on the function itself, so adding the resource-based policy resolves the problem (B).Why the Other Options Are Wrong
A creates an S3 bucket policy granting the bucket permission to invoke the Lambda function. The direction is inverted: the bucket is the caller attempting the invocation, and the resource that must grant permission is the Lambda function. A bucket policy alone therefore cannot authorize S3 to invoke the function. C configures an SQS queue as an OnFailure destination and has the function read from both SQS and S3 notifications. An OnFailure destination only receives events for invocations that already failed asynchronously, so if the function never runs there is nothing to route; it does not authorize the S3 trigger. D routes the S3 event notifications to an SQS queue and has the function poll it, adding an unnecessary buffering layer while still leaving the Lambda without a resource-based policy permitting S3 invocation, so the trigger would still fail. B is correct.Community Comment Notes
Community voted B (90). Ky_24 and Impromptu both explained that the Lambda function must have a resource-based policy granting Amazon S3 permission to invoke it, with Impromptu linking the AWS documentation on Lambda resource-based policies and noting the equivalent AWS::Lambda::Permission resource in CloudFormation. ArunRav and Srikantha gave the same conclusion from the S3-to-Lambda invocation direction.Official Reference
Related Analysis
Practice All DOP-C02 Questions
Access 85 questions with complete answers and detailed explanations.
View Full DOP-C02 Practice Test →