š Make Lambda Read Your S3 File (and Fix Access Denied)
In previous article, Lambda only printed the file name. Today it reads the file's content. On the way, you'll hit a real AccessDenied error and fix it with the IAM knowledge.
š§ The Plan
Upload file ā S3 ā Lambda ā Read file content ā CloudWatch Logs
š» Step 1: Update the Code
Open your s3-upload-logger function and replace the code:
1
2
3
4
5
6
7
8
9
10
11
12
import boto3
from urllib.parse import unquote_plus
s3 = boto3.client("s3")
def lambda_handler(event, context):
record = event["Records"][0]["s3"]
bucket = record["bucket"]["name"]
key = unquote_plus(record["object"]["key"])
response = s3.get_object(Bucket=bucket, Key=key)
content = response["Body"].read().decode("utf-8")
print("File:", key)
print("Content:", content)
return {"statusCode": 200}boto3 is the AWS SDK for Python, already available in Lambda.
unquote_plus decodes special characters in the file name (a space arrives as +).
get_object fetches the file from S3.
unquote_plus decodes special characters in the file name (a space arrives as +).
get_object fetches the file from S3.
Click Deploy.
š„ Step 2: Watch It Fail
Upload a text file, such as hello.txt containing a short sentence, then check CloudWatch Logs. You'll see an error like:
AccessDenied: User ... is not authorized to perform: s3:GetObject
This is exactly what we learned yesterday. The execution role only allows writing logs, so Lambda has no permission to read from S3. š
š§ Step 3: Grant Least-Privilege Access
Open your function ā Configuration ā Permissions ā click the role name.
In IAM, click Add permissions ā Create inline policy.
Switch to the JSON tab and paste:
Switch to the JSON tab and paste:
1
2
3
4
5
6
7
8
9
10
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::your-bucket-name/*"
}
]
}Replace your-bucket-name with your bucket, name the policy (for example read-my-bucket), and click Create policy.
Notice that it allows only GetObject on one bucket. That's least privilege in practice.
ā
Step 4: Test Again
Upload a new file, then open the latest log stream. This time you'll see your file name and its content printed. š
(Policy changes can take a few seconds to apply. If it still fails, wait a moment and upload again.)
š Good to Know
This works for small text files. For large files or binary files (images, PDFs), you'd handle the data differently.
The code reads only the first record in the event. Real applications loop through event["Records"].
The code reads only the first record in the event. Real applications loop through event["Records"].
š® What's Next?
Printing content to logs is useful for learning, but real applications store results. Tomorrow I'll explore Amazon DynamoDB and save each uploaded file's details in a database.
Upload file ā S3 ā Lambda ā DynamoDB
š¬ Your turn: Upload a file with your own name inside it. Does the log show it? Then try removing the policy and see the error again.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article