GetBucketLocation - Acces Denied - amazon-web-services

Question

I have a lambda that I need to write that requires the bucket location for a given S3 bucket. I've set the permission to allow GetBucketLocation on all S3 buckets but I still get the following error:
An error occurred (AccessDenied) when calling the GetBucketLocation operation: Access Denied
I have even attached admin role rights to the function and I still get the above message. Is there any way to have GetBucketLocation to work?
For completeness the function looks as following:
# Libraries
# Standard Libaries
import json
import time
import urllib
# Third Party Libraries
import boto3
CLOUDFRONT_CLIENT = boto3.client('cloudfront')
S3_CLIENT = boto3.client('s3')
def get_cloudfront_distribution_id(bucket):
bucket_location = S3_CLIENT.get_bucket_location(Bucket=bucket) # <<<--- THIS PART FAILS
bucket_origin = f'{bucket}.s3.{bucket_location}.amazonaws.com'
cf_distro_id = None
# Create a reusable Paginator
paginator = CLOUDFRONT_CLIENT.get_paginator('list_distributions')
page_iterator = paginator.paginate()
...
return cf_distro_id
def lambda_handler(event, context):
'''
Creates a cloudfront invalidation for content added to a S3 bucket
'''
# Get the object from the event.
bucket = event['Records'][0]['s3']['bucket']['name']
key = urllib.parse.unquote_plus(event['Records'][0]['s3']['object']['key'])
if not key.startswith('/'):
key = f'/{key}'
cf_distro_id = get_cloudfront_distribution_id(bucket)
...
The IAM role
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Roles #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
LambdaRole:
Description: IAM role to allow Lambda to invalidates content in a cloudfront distro when S3 content changes
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Sid: 1
ManagedPolicyArns:
- !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
RoleName: !Join
- '-'
- - !Ref AWS::StackName
- Role
The IAM Policy
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Policies #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
LambdaPolicy:
Description: Setting IAM policy for service role for Lambda to invalidate cloudfront S3 cache
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action:
- s3:GetObject
- s3:GetObjectVersion
- s3:GetBucketVersioning
- s3:PutObject
Effect: Allow
Resource:
- !Sub 'arn:${AWS::Partition}:s3:::${ArtifactsBucket}'
- !Sub 'arn:${AWS::Partition}:s3:::${ArtifactsBucket}/*'
- Action:
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:DeleteLogGroup
- logs:DeleteLogStream
- logs:PutLogEvents
Effect: Allow
Resource:
- !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:*'
- Action:
- cloudfront:CreateInvalidation
- cloudfront:GetDistribution
- cloudfront:GetStreamingDistribution
- cloudfront:GetDistributionConfig
- cloudfront:GetInvalidation
- cloudfront:ListInvalidations
- cloudfront:ListStreamingDistributions
- cloudfront:ListDistributions
Effect: Allow
Resource: '*'
- Action:
- s3:GetBucketLocation
- s3:ListBucket
Effect: Allow
Resource:
- !Sub 'arn:${AWS::Partition}:s3:::*'
PolicyName: !Join
- '-'
- - !Ref AWS::StackName
- LambdaPolicy
Roles:
- !Ref LambdaRole
The generated policy found in IAM
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"cloudfront:GetDistribution",
"cloudfront:GetStreamingDistribution",
"cloudfront:ListInvalidations",
"cloudfront:ListDistributions",
"cloudfront:GetInvalidation",
"cloudfront:ListStreamingDistributions",
"cloudfront:GetDistributionConfig",
"cloudfront:CreateInvalidation"
],
"Resource": "*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"logs:CreateLogStream",
"logs:DeleteLogGroup",
"s3:GetBucketVersioning",
"logs:CreateLogGroup",
"logs:DeleteLogStream",
"logs:PutLogEvents",
"s3:GetObjectVersion"
],
"Resource": [
"arn:aws:logs:us-east-1:123456789000:*",
"arn:aws:s3:::123456789000-util-invalidate-cloudfront-artifactsbucket/*",
"arn:aws:s3:::123456789000-util-invalidate-cloudfront-artifactsbucket"
]
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::*"
}
]
}