Lambda S3 Read Failure: Fix the Bucket Policy Resource ARN
Short answer
C Change the Resource element to arn:aws:s3:::DOC-EXAMPLE-BUCKET/* so the s3:GetObject statement matches the objects that MyLambdaFunction reads.
Question
Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?
Key Takeaways
The question tests the distinction between bucket-level and object-level S3 ARNs, and the main trap is changing the Principal to the Lambda service instead of correcting the Resource for s3:GetObject.
S3 bucket policies granting s3:GetObject must use an object-level ARN; changing the Resource to arn:aws:s3:::DOC-EXAMPLE-BUCKET/* (C) restores Lambda read access.
Common mistake: A likely wrong choice is to change the policy Principal to lambda.amazonaws.com, but Lambda signs S3 requests with its execution role, and that change still leaves s3:GetObject scoped to the bucket ARN rather than the objects.
Expert Analysis
What the policy must authorize
The failure is an authorization mismatch, not a Lambda runtime problem. s3:GetObject is an object-level S3 action, so its Resource must identify the objects: arn:aws:s3:::DOC-EXAMPLE-BUCKET/*. A bucket ARN ending at DOC-EXAMPLE-BUCKET only covers bucket-level actions such as s3:ListBucket. If the policy grants s3:GetObject on the bucket ARN, S3 evaluates the request against the object key and finds no matching resource, so Lambda receives AccessDenied even though the principal looks correct. Option C is the precise fix.
Why the other changes do not solve it
Option A asks you to remove the Condition and change the Principal. Removing a condition can widen access, and it does not repair an object-level action pointed at a bucket ARN. Also, changing the principal to the Lambda service principal is not the right model: Lambda calls S3 using the function's execution role credentials, so the bucket policy should name that role or an account principal, not lambda.amazonaws.com. Option B changes only Action; if the resource remains the bucket ARN, adding or altering actions does not make GetObject valid. Option D is invalid for an S3 bucket policy because it points Resource at a Lambda function ARN; S3 policies evaluate S3 resources, not Lambda resources.
Adjacent decision and operational consequence
When you fix this, decide separately between listing and reading objects. If code calls ListObjectsV2, grant s3:ListBucket on the bucket ARN; if it then calls GetObject, grant s3:GetObject on bucket/. A scenario change that would flip the answer is a policy that already has DOC-EXAMPLE-BUCKET/ but includes a condition key the Lambda request does not carry, such as a VPC endpoint or source ARN. Then the condition, not the resource, becomes the prime suspect. Leaving the bucket ARN in place produces deterministic AccessDenied failures; teams may waste time rotating credentials or adding broad s3:* or wildcard principals, which increases exposure without fixing the resource mismatch.
Official Reference
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-arn-format.html
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html
- https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html
These links open the official vendor documentation in a new tab.
Exam Strategy
In S3 policy troubleshooting, match the action to the resource level before editing Principal or Condition. Bucket-level actions such as s3:ListBucket use arn:aws:s3:::bucket; object-level actions such as s3:GetObject, s3:PutObject and s3:DeleteObject require arn:aws:s3:::bucket/*. If a stem says an application can list but not read, or read but not list, check for exactly that mismatch first. Then verify the calling identity's IAM policy and any condition keys are present in the actual request.
Frequently Asked Questions
Why doesn't a bucket policy granting s3:GetObject on the bucket ARN work?
Should the Principal be lambda.amazonaws.com so MyLambdaFunction can read S3?
Would removing the bucket policy Condition always fix Lambda access?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Nitttt 👍 1 Answered CShould we study for scs-c02 as well?
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →