Add a resource-based policy on the Lambda function granting Amazon S3 permission to invoke it

DOP-C02 By islever Editorial Last updated

Manage event sources to process, notify, and take action in response to events. Implement CI/CD pipelines.

Short answer

B Add a resource-based policy to the Lambda function granting Amazon S3 permission to invoke it on the bucket.

Question

A company configured an Amazon S3 event source for an AWS Lambda function. The company needs the Lambda function to run when a new object is created or an existing object is modified in a specific S3 bucket. The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the new or modified S3 object. The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table. The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table. During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified. Which solution will resolve these problems?
  1. Create an S3 bucket policy for the S3 bucket that grants the S3 bucket permission to invoke the Lambda function.
  2. Create a resource policy for the Lambda function to grant Amazon S3 permission to invoke the Lambda function on the S3 bucket. Correct Answer
  3. Configure an Amazon Simple Queue Service (Amazon SQS) queue as an OnFailure destination for the Lambda function. Update the Lambda function to process messages from the SQS queue and the S3 event notifications.
  4. Configure an Amazon Simple Queue Service (Amazon SQS) queue as the destination for the S3 bucket event notifications. Update the Lambda function's execution role to have permission to read from the SQS queue. Update the Lambda function to consume messages from the SQS queue.

Key Takeaways

The function's execution role governs what the code may do once running, not whether S3 may trigger it, so the missing piece is a resource-based policy on the Lambda function naming Amazon S3 as an allowed invoker (B). Option A has the direction reversed: an S3 bucket policy granting the bucket permission to invoke Lambda does not authorize the invocation, because the resource requiring permission is the Lambda function. Options C and D introduce an SQS queue, adding a buffering layer that changes the architecture without addressing the missing invocation permission.

S3 event notifications to Lambda require a resource-based policy on the Lambda function that permits the S3 service to invoke it; without that permission statement the invocation never happens, which is why the function does not run on object creation or modification even though its execution role correctly permits reading the object and writing to DynamoDB. Adding a resource-based policy to the Lambda function allowing Amazon S3 to invoke it on that bucket resolves the problem.

Common mistake: Creating an S3 bucket policy that grants the bucket permission to invoke the Lambda function (A) — the bucket is the caller, not the callee; authorization for a Lambda invocation must be granted on the Lambda function's resource-based policy, so a bucket policy alone cannot authorize it. Adding an SQS queue as an OnFailure destination (C) or routing S3 notifications through SQS (D) — neither addresses the missing resource-based policy; an OnFailure destination only receives failed asynchronous invocations after they have already failed, so it cannot fix a function that never runs in the first place.

Expert Analysis

Why the Answer Is Correct

For Amazon S3 to invoke an AWS Lambda function through event notifications, the Lambda function must carry a resource-based policy that explicitly allows the S3 service principal to invoke it, typically scoped with a SourceArn condition to the specific bucket. AWS documentation on Lambda resource-based policies describes exactly this requirement, and in CloudFormation it corresponds to the AWS::Lambda::Permission resource. Since the scenario already confirms the execution role can read from S3 and write to DynamoDB, the only missing element preventing the function from running is that invocation permission on the function itself, so adding the resource-based policy resolves the problem (B).

Why the Other Options Are Wrong

A creates an S3 bucket policy granting the bucket permission to invoke the Lambda function. The direction is inverted: the bucket is the caller attempting the invocation, and the resource that must grant permission is the Lambda function. A bucket policy alone therefore cannot authorize S3 to invoke the function. C configures an SQS queue as an OnFailure destination and has the function read from both SQS and S3 notifications. An OnFailure destination only receives events for invocations that already failed asynchronously, so if the function never runs there is nothing to route; it does not authorize the S3 trigger. D routes the S3 event notifications to an SQS queue and has the function poll it, adding an unnecessary buffering layer while still leaving the Lambda without a resource-based policy permitting S3 invocation, so the trigger would still fail. B is correct.

Community Comment Notes

Community voted B (90). Ky_24 and Impromptu both explained that the Lambda function must have a resource-based policy granting Amazon S3 permission to invoke it, with Impromptu linking the AWS documentation on Lambda resource-based policies and noting the equivalent AWS::Lambda::Permission resource in CloudFormation. ArunRav and Srikantha gave the same conclusion from the S3-to-Lambda invocation direction.

Official Reference

https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Impromptu 👍 3 Answered B
    https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html The lambda resource policy should allow S3. Or in cloudformation terms: adding the AWS::Lambda::Permission
  2. ArunRav 👍 3 Answered B
    Lambda should allow to be invoked by S3 bucket Hence B
  3. Ky_24 👍 2 Answered B
    1. S3-to-Lambda Invocation: • When you configure Amazon S3 to trigger an AWS Lambda function, S3 must have explicit permission to invoke the function. This is done by attaching a resource-based policy to the Lambda function. • Without this policy, even if S3 event notifications are configured, the Lambda function will not be triggered because S3 does not have the necessary permissions to invoke the function. 2. Solution Details: • A resource policy for the Lambda function specifies that the S3 bucket is allowed to invoke the Lambda function. This is configured by using the AWS CLI, AWS SDKs, or directly in the AWS Management Console.
  4. Srikantha 👍 1 Answered B
    Event Trigger Issue: The Lambda function is not being triggered when objects are created or modified in the S3 bucket. A common reason for this issue is that Amazon S3 does not have the necessary permissions to invoke the Lambda function. Lambda Function Resource Policy: Unlike some AWS services (e.g., SNS, SQS), which can automatically invoke Lambda if they have permissions in their service role, S3 requires an explicit resource-based policy on the Lambda function to grant it invocation permissions. This means S3 needs explicit permission to trigger the Lambda function when events occur. Why Option B Works: Adding a resource-based policy to the Lambda function allows S3 to invoke the function when an event (PUT/POST operation) occurs. The policy should include an "s3.amazonaws.com" principal and an action of "lambda:InvokeFunction", granting S3 the ability to trigger Lambda.
  5. f4b18ba 👍 1 Answered A
    Event Source Mapping and Permission Requirements: For Amazon S3 to invoke a Lambda function, the Lambda function must have a resource-based policy that grants Amazon S3 permission to invoke it. Without this resource-based policy, even if the event source is correctly configured, the Lambda function will not be triggered because S3 is not authorized to invoke it. Resource Policy for Lambda Function: A resource policy on the Lambda function explicitly allows Amazon S3 to invoke the function for the specified bucket events (e.g., object creation or modification). This resolves the issue by enabling S3 to trigger the Lambda function Action - lambda:InvokeFunction allows S3 to invoke the Lambda function. https://docs.aws.amazon.com/lambda/latest/dg/with-s3.html

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Optimizing Amazon Timestream Query Performance

S-grade

Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

S-grade

Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

S-grade

Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

S-grade

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide