denying access to S3 bucket except specific lambda - amazon-web-services

Question

I am trying to add the below bucket policy that would deny access to the bucket for any (get, put, delete) operation except my AWS lambda. Can you please help why this is not working
{
"Version": "2012-10-17",
"Id": "Policy#####",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:DeleteObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::#####-s3-file-upload/*"
],
"Condition": {
"ArnNotEquals": {
"aws:SourceArn": "arn:aws:lambda:us-east-1:5######1:function:temp_read_s3"
}
}
}
]
}

Answer 1

Step 1: Create lambda execution role for lambda.
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::XXX-s3-file-upload",
"arn:aws:s3:::XXX-s3-file-upload/*"
]
}]
}
Step 2: Add that role to lambda
Step 3: Add that role to S3 policy to restrict only that role.
{
"Version": "2008-10-17",
"Statement": [{
"Sid": "S3 Access Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::2XXXXXXXXX:role/executionrole"
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::sample_bucket",
"arn:aws:s3:::sample_bucket/*"
]
}]
}
This way you can restrict only specific lambda. For other lambda you can use different execution role.
Reference : https://aws.amazon.com/premiumsupport/knowledge-center/lambda-execution-role-s3-bucket/

Answer 2

solution for lambda is to add an assumed role. With a bit of digging and troubleshooting, I realized that the Lambda function assumes the role you provide, and that assumed role must also be added to the S3 bucket policy as below.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "2",
"Effect": "Deny",
"NotPrincipal": {
"AWS": [
"arn:aws:iam::55account_id111:role/iam_policy_role",
"arn:aws:sts::55account_id111:assumed-role/#####_lambda_role/lambda_function"
]
},
"Action": [ "s3:GetObject",
"s3:PutObject",
"s3:DeleteObject" ]
"Resource": [
"arn:aws:s3:::######-bucketName/*",
"arn:aws:s3:::######-bucketName"
]
}
]
}