Unable to download file from S3 because "A client error (403) occurred when calling the HeadObject operation: Forbidden"

Question

I am trying to download a file in code from an S3 bucket I created through AWS CDK, but got this error "A client error (403) occurred when calling the HeadObject operation: Forbidden". At first I thought it was because I didn't add s3:GetObject action to the IAM policy statement, but I still get that error. Below is how I created the bucket:

    # S3
    bucket = s3.Bucket(
        self, "testS3Bucket", bucket_name=f"test_s3_bucket"
    )
    service_lambda.add_to_role_policy(
        iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            actions=[
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:HeadObject",
            ],
            resources=[bucket.arn_for_objects("*")],
        )
    )

Here is the code where I download the file from S3:

def download_file(self, file_name, s3_bucket):
    try:
        file = self.s3.Object(s3_bucket, file_name).load()
    except ClientError as e:
        if e.response["Error"]["Code"] == "404":
            log.error("File does not exist for partner")
            return {}
        else:
            raise e
    except Exception as e:
        raise e

    return file

Does anybody know how I can get past this issue?

Answer 1

A simpler way to grant your lambda appropriate permissions would be something like this:

bucket = s3.Bucket(
    self, "testS3Bucket", bucket_name=f"test_s3_bucket"
)
bucket.grant_read_write(service_lambda.role)

Based on docs

If an encryption key is used, permission to use the key for encrypt/decrypt will also be granted.

Give that a try and see if you still receive a permissions error