S3：即使附加了 AmazonS3FullAccess，访问也被拒绝

Question

When invoking this lambda function:

    var params = {
        Bucket: sourceBucket,
        Key: sourceKey,
        ACL: 'public-read-write'
    };

    s3.putObjectAcl(params, function(err, data){
        if (err){
            callback(err)
        }
    })

I tried 2 execution roles for this lambda function, but still encountered the above error:

1. IAM Role with AmazonS3FullAccess policy attached.
2. IAM Role with the following policies:
   • AWSLambdaExecute policy
   • This Inline policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObjectVersionAcl",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::my-bucket-name/*"
        }
    ]
}

May I know what am I doing wrong or have missed? Thank you!

Answer 1

This question was answered by jarmod in the comments:

Disable the "Block Public Access" Setting in your bucket.

Why?

"If an object is written to an AWS Account or S3 bucket with S3 Block Public Access enabled, and that object specifies any type of public permissions via ACL or policy, those public permissions are blocked. "

Source: aws.amazon.com/s3/features/block-public-access