A company runs a batch processing job on a schedule using AWS Lambda. The job processes files from an S3 bucket and writes results to another S3 bucket. Recently, the job has been failing with the error 'Access Denied' when trying to write to the destination bucket. The Lambda function's execution role has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::source-bucket/*",
"arn:aws:s3:::source-bucket"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject"
],
"Resource": "arn:aws:s3:::destination-bucket/*"
}
]
}

The Lambda function also has a VPC configuration to access an RDS instance. The S3 buckets are in the same region. The Solutions Architect verified that the destination bucket policy does not deny access. What is the MOST likely cause of the 'Access Denied' error?

Question

A company runs a batch processing job on a schedule using AWS Lambda. The job processes files from an S3 bucket and writes results to another S3 bucket. Recently, the job has been failing with the error 'Access Denied' when trying to write to the destination bucket. The Lambda function's execution role has the following IAM policy attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::source-bucket/*",
                "arn:aws:s3:::source-bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::destination-bucket/*"
        }
    ]
}

The Lambda function also has a VPC configuration to access an RDS instance. The S3 buckets are in the same region. The Solutions Architect verified that the destination bucket policy does not deny access. What is the MOST likely cause of the 'Access Denied' error?

Accepted Answer

The Lambda function is in a VPC without an S3 VPC endpoint, so it cannot reach S3.. The Lambda function is attached to a VPC and does not have an S3 VPC endpoint. When a Lambda function is configured to access a VPC, it loses public internet connectivity unless a NAT gateway or VPC endpoints are provided. Without an S3 VPC endpoint (gateway type) in the VPC, the function cannot reach the S3 API, causing PutObject calls to fail with 'Access Denied' (even though the IAM policy allows it). Option B is incorrect because the IAM policy allows s3:GetObject and s3:ListBucket on the source bucket, and the error is on write to the destination bucket. Option C is incorrect because the IAM policy explicitly allows s3:PutObject on the destination bucket. Option D is incorrect because the destination bucket policy does not deny access, as stated in the question.

Answer

The Lambda function does not have permissions to read from the source bucket.

Answer

The IAM policy does not allow s3:PutObject on the destination bucket.

Answer

The destination bucket policy denies the Lambda function's access.

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Question Discussion