将S3存储桶文件复制到辅助存储桶？

Question

Issue: My access is being denied when I run the following AWS Lambda code:

require 'json'
require "aws-sdk-s3"

def lambda_handler(event:, context:)
    client = Aws::S3::Client.new(region: 'us-east-2')

    record = event["Records"][0]
    key = record.dig *%w(s3 object key)

    client.copy_object({
      bucket: "bucket-name", 
      copy_source: "#{key}", 
      key: "#{key}", 
    })

end

Error:

"errorType": "Function<Aws::S3::Errors::AccessDenied>",

My IAM role:

• AmazonS3FullAccess : AWS managed policy

• AWSLambdaBasicExecutionRole-e41b74ba-3cef-4470-8f1c-3f900591016c : Managed policy

• AWSConfigRulesExecutionRole

Shouldn't this be good to go?

The purpose of the lambda is to take files uploaded to the bucket and copy them over to another bucket.

Answer 1

Since the code is run in AWS Lambda, your IAM role permissions have no impact on the code execution. Instead Lambda execution role needs to have the S3 permission in this case.

You need to create a new role with required permissions and update Lambda execution role to the newly created role.

Answer 2

require 'json'
require "aws-sdk-s3"

def lambda_handler(event:, context:)
    client = Aws::S3::Client.new(region: 'us-east-2')

    record = event["Records"][0]
    key = record.dig *%w(s3 object key)

    client.copy_object({
      bucket: "bucket-name", 
      copy_source: "#{key}", 
      key: "#{key}", 
    })

end

Needs to be:

require 'json'
require "aws-sdk-s3"

    def lambda_handler(event:, context:)
        client = Aws::S3::Client.new(region: 'us-east-2')

        record = event["Records"][0]
        key = record.dig *%w(s3 object key)

        client.copy_object({
          bucket: "bucket-name", 
          copy_source: "/bucketname/#{key}", 
          key: "#{key}", 
        })

    end

Must specify the source which is the bucket-name/file-name

Answer 3

The copy_object() command requires:

• Source bucket
• Source key
• Destination bucket
• Destination key

Your code is only referencing one bucket name and is using the same Key.

The documentation shows:

resp = client.copy_object({
  bucket: "destinationbucket", 
  copy_source: "/sourcebucket/HappyFace.jpg", 
  key: "HappyFaceCopyjpg", 
})

You'll notice that copy_source includes the source bucket name.