如何使用 CDK Python 通过 lambda 访问跨区域 s3 存储桶

Question

I have created lambda in region A and a S3 bucket in region B, trying to access bucket from lambda boto-3 client but getting an error(access denied).Please suggest some solution for this in python CDK.Will I need to create any specific policy for it.

Answer 1

You have to explicitly pass the region name of the bucket if it is not in the same region as the lambda (because AWS have region specific endpoints for S3 which needs to be explicitly queried when working with s3 api).

Initialize your boto3 S3 client as:

import boto3

client = boto3.client('s3', region_name='region_name where bucket is')

see this for full reference of boto3 client: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/session.html#boto3.session.Session.client

---------Edited------------ you also need the following policy attached to (or inline in) the role of your lambda:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ExampleStmt",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::YOUR-BUCKET-NAME/*"
      ]
    }
  ]
}

If you need to list and delete the objects too, then you need to have the following policy instead, attached to (or inline in) the role of the lambda:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ExampleStmt1",
      "Action": [
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::YOUR-BUCKET-NAME/*"
      ]
    },
    {
      "Sid": "ExampleStmt2",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::YOUR-BUCKET-NAME"
      ]
    }
  ]
}

Answer 2

Your lambda function requires permissions to read S3 .

The easiest way to enable that is to add AWS managed policy:

arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

to your lambda execution role .

Specifying region is not required, as S3 buckets have global scope.