如何通过 AWS SAM 提供 Lambda S3 策略

Question

I'm trying to provide my Lambda function with the S3FullAccessPolicy policy. Note the target bucket is not configured within the template.yaml - it already exists. Considering the syntax examples from this documentation I have three options:

1.AWS managed policy named:

  Policies:
  - S3FullAccessPolicy

2.AWS SAM policy template (SQSPollerPolicy) defined:

Policies:
  - S3FullAccessPolicy:
      BucketName: abc-bucket-name    

3.Or an inline policy document:

  Policies:
  - Statement:
    ...

In trying #1 I get an error that says it seems to suggest I need to provide an arn. If this is the case where would I provide it? The error:

1 validation error detected: Value 'S3FullAccessPolicy' at 'policyArn' failed to satisfy constraint:
 Member must have length greater than or equal to 20

For #2 I provide the bucket name but it says that the policy is 'invalid'. I've tried adding quotes and replacing the name with an arn - but no luck.

And #3 - I can find the code for the policy here but that's in yaml so I wonder if that's even what I'm supposed to be using.

What am I missing here? I'm open to using any one of these options but right now I'm 0/3.

The full Lambda function:

  testFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda/testFunction/
      Handler: app.lambda_handler
      Runtime: python3.8
      Timeout: 900
      Policies:
        - S3FullAccessPolicy

Answer 1

I used below template without any issues.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31


Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./hello_world/
      Handler: app.lambda_handler
      Runtime: python3.8
      Tracing: Active
      Policies:
        - S3FullAccessPolicy:
            BucketName: existingbucketname # bucket name without arn

Ran it using below command and it deployed successfully.

sam deploy --stack-name sample-stack --s3-bucket bucket-to-deploy --capabilities CAPABILITY_IAM