After giving all the rights to invoke function. My Lambda function is not able to invoke another function . Every time I am getting timeout having `30 seconds timeout` issue.  It looks like lambda is not able to get another lambda function

My lambdas are in same region, same policy, same security group .. Also VPC are same in both lambdas. The only thing is different now is lambda functions 

Here are the role rights 

1) created  `AWSLambdaExecute` and `AWSLambdaBasicExecutionRole` 

2) Created one lambda function which is to be called
**Lambda_TEST**

    exports.handler = function(event, context) {
      console.log(&#39;Lambda TEST Received event:&#39;, JSON.stringify(event, null, 2));
      context.succeed(event);
    };

3) Here is a another function from where it is called .

    var AWS = require(&#39;aws-sdk&#39;);
    AWS.config.region = &#39;us-east-1&#39;;
    var lambda = new AWS.Lambda();

    exports.handler = function(event, context) {
     var params = {
       FunctionName: &#39;Lambda_TEST&#39;, // the lambda function we are going to invoke
       InvocationType: &#39;RequestResponse&#39;,
       LogType: &#39;Tail&#39;,
       Payload: &#39;{ &quot;name&quot; : &quot;Arpit&quot; }&#39;
     };

      lambda.invoke(params, function(err, data) {
       if (err) {
        context.fail(err);
       } else {
       context.succeed(&#39;Lambda_TEST said &#39;+ data.Payload);
      }
     })
    };

Reference taken from : [This link][1]


  [1]: https://stackoverflow.com/questions/35754766/nodejs-invoke-an-aws-lambda-function-from-within-another-lambda-function

AWS lambda invoke not calling another lambda function - Node.js

I am trying a small example  with AWS API Gateway and IAM authorization. The AWS API Gateway generated the below Endpoint : 

    https://xyz1234.execute-api.us-east-2.amazonaws.com/Users/users
with POST action and no parameters.

Initially I had turned off the IAM for this POST Method and I verified results using Postman it works. 
Then I created a new IAM User and attached AmazonAPIGatewayInvokeFullAccess Policy to the user thereby giving permission to invoke any API&#39;s. Enabled the IAM for the POST Method.

I  then went to Postman - and added Authorization with AccessKey, Secret Key, AWS Region as `us-east-2` and Service Name as `execute-api` and tried to execute the Request but I got InvalidSignatureException Error with 403 as return code. 

The body contains following message :

    Signature expired: 20170517T062414Z is now earlier than 20170517T062840Z (20170517T063340Z - 5 min.)&quot; 

What am I missing ?

Signature expired: is now earlier than error : InvalidSignatureException

I have created an IAM user account. Now I want to connect with this user to the AWS console.

AWS says:

&gt;For Users who need access to the AWS Management Console, create a password in the Users panel after completing this wizard.

I have created one password for the IAM user.

Trying to log in to the AWS Console using the new user name and the password does not work.

What do I have to do?

How do I log in to AWS Console with an IAM user account?

How can I allow all members of a Group to assume a Role in AWS IAM?

I tried Using the following statement but as specified in [AWS IAM Principal Element][1], a Group can not be a Principal.

I want to achieve something like below:

    {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
        {
          &quot;Sid&quot;: &quot;&quot;,
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Principal&quot;: {
            &quot;AWS&quot;: &quot;arn:aws:iam::***:group/developer&quot;
          },
          &quot;Action&quot;: &quot;sts:AssumeRole&quot;
        }
      ]
    }

The idea is that all members of the group `group/developer` should be able to assume the role. The objective is that I should be saved from having to specify each member in a group individually.

Is there a way to achieve this?

[1]:
http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Principal

How can I allow a Group to assume a Role?

I am using the Boto 3 python library, and want to connect to AWS CloudFront.
I need to specify the correct AWS Profile (AWS Credentials), but looking at the official documentation, I see no way to specify it.

I am initializing the client using the code:
`client = boto3.client(&#39;cloudfront&#39;)`

However, this results in it using the default profile to connect.
I couldn&#39;t find a method where I can specify which profile to use.


How to choose an AWS profile when using boto3 to connect to CloudFront

I am getting: 

&gt; An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied 

When I try to get folder from my S3 bucket.

Using this command: 

    aws s3 cp s3://bucket-name/data/all-data/ . --recursive

The IAM permissions for the bucket look like this:

    {
    &quot;Version&quot;: &quot;version_id&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Sid&quot;: &quot;some_id&quot;,
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
                &quot;s3:*&quot;
            ],
            &quot;Resource&quot;: [
                &quot;arn:aws:s3:::bucketname/*&quot;
            ]
        }
    ] }


What do I need to change to be able to `copy` and `ls` successfully?

AccessDenied for ListObjects for S3 bucket when permissions are s3:*

Looking for a quick way to pull my account number, I had originally thought of using `aws iam get-account-authorization-details --max-items 1` but there are several issues with doing it this way. Is there a way to do this that might not cross account origins?

Quick way to get AWS Account number from the AWS CLI tools?

I `cd` into the directory where all the pem/key files are and run the following:

    aws iam upload-server-certificate 
        --server-certificate-name certificate_name 
        --certificate-body file://webservercertificate.pem  
        --private-key file://server.key   
        --certificate-chain file://certificate_chain_file.pem 

I get the following error: 



&gt; A client error (InvalidClientTokenId) occurred when calling the
&gt; UploadServerCertificate operation: The security token included in the
&gt; request is invalid.


I have 1 &#39;user&#39; in &#39;users&#39;. That user has been assigned the following permissions:

    IAMFullAccess IAMReadOnlyAccess IAMUserSSHKeys


I&#39;ve downloaded the credentials for this user and put them into my user variables

    AWS_ACCESS_KEY ****
    AWS_SECRET_KEY ****

I have 1 role on my elastic beanstalk  `aws-elasticbeanstalk-ec2-role`

How can I resolve the error &quot;The security token included in the request is invalid&quot; when running aws iam upload-server-certificate?

Today I have a new AWS Lambda question, and can&#39;t find anywhere in Google.

I new a Lambda function, there is no question.
But when I input any code in this function[eg. console.log();] and click  &quot;Save&quot;, error is occured:
&quot;The provided execution role does not have permissions to call DescribeNetworkInterfaces on EC2&quot; 

    exports.handler = (event, context, callback) =&gt; {
        callback(null, &#39;Hello from Lambda&#39;);
        console.log();  // here is my code   
    }; 

I bound the function with Role: lambda_excute_execution(Policy:AmazonElasticTranscoderFullAccess)
And this function is not bound with any triggers now.

And then, I give the role &quot;AdministratorAccess&quot; Policy, I can save my source code correctly.

This role can run Functions successfully before today.

Is anyone know this error?

Thanks Very much!

AWS Lambda:The provided execution role does not have permissions to call DescribeNetworkInterfaces on EC2

I want to attach one of the pre-existing AWS managed roles to a policy, here&#39;s my current code:

&lt;!-- language: lang-hcl --&gt;

    resource &quot;aws_iam_role_policy_attachment&quot; &quot;sto-readonly-role-policy-attach&quot; {
      role       = &quot;${aws_iam_role.sto-test-role.name}&quot;
      policy_arn = &quot;arn:aws:iam::aws:policy/ReadOnlyAccess&quot;
    }

Is there a better way to model the managed policy and then reference it instead of hardcoding the ARN?  It just seems like whenever I hardcode ARNs / paths or other stuff like this, I usually find out later there was a better way.

Is there something already existing in Terraform that models managed policies?  Or is hardcoding the ARN the &quot;right&quot; way to do it?


Terraform: correct way to attach AWS managed policies to a role?

I&#39;m using AWS&#39;s CloudFormation, and I recently spent quite a bit of time trying to figure out why the role I had created and attached policies to was not enabling my ECS task to send a message to a Simple Queue Service (SQS) queue. 

I realized that I was incorrectly attaching the SQS permissions policy to the `Execution Role` when I should have been attaching the policy to the `Task Role`. I cannot find good documentation that explains the difference between the two roles. CloudFormation documentation for the two of them are here: [ExecutionRole](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-executionrolearn) and [TaskRole](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-taskrolearn)

Difference between AWS Elastic Container Service&#39;s (ECS) ExecutionRole and TaskRole

I&#39;m trying to invoke a lambda function from node.
```javascript
var aws = require(&#39;aws-sdk&#39;);
var lambda = new aws.Lambda({
    accessKeyId: &#39;id&#39;,
    secretAccessKey: &#39;key&#39;,
    region: &#39;us-west-2&#39;
});

lambda.invoke({
    FunctionName: &#39;test1&#39;,
    Payload: JSON.stringify({
        key1: &#39;Arjun&#39;,
        key2: &#39;kom&#39;,
        key3: &#39;ath&#39;
    })
}, function(err, data) {
    if (err) console.log(err, err.stack);
    else     console.log(data);
});
```

The keys are for an IAM user. The user has `AWSLambdaExecute` and `AWSLambdaBasicExecutionRole` policies attached.

I get a permission error:
`AccessDeniedException: User: arn:aws:iam::1221321312:user/cli is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-west-2:1221321312:function:test1`

I read the docs and several blogs, but I&#39;m unable to authorise this user to invoke the lambda function. How do get this user to invoke lambda?


AccessDeniedException: User is not authorized to perform: lambda:InvokeFunction

I&#39;ve recently started using the new Amazon Elasticsearch Service and I can&#39;t seem to figure out the access policy I need so that I can only access the services from my EC2 instances that have a specific IAM role assigned to them.

Here&#39;s an example of the access policy I currently have assigned for the ES domain:

    {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
        {
          &quot;Sid&quot;: &quot;&quot;,
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Principal&quot;: {
            &quot;AWS&quot;: [
              &quot;arn:aws:iam::[ACCOUNT_ID]:role/my_es_role&quot;,
            ]
          },
          &quot;Action&quot;: &quot;es:*&quot;,
          &quot;Resource&quot;: &quot;arn:aws:es:us-east-1:[ACCOUNT_ID]:domain/[ES_DOMAIN]/*&quot;
        }
      ]
    }

But as I said, this doesn&#39;t work.  I log into the EC2 instance (which has the `my_es_role` role attached to it) and attempt to run a simple curl call on the &quot;https://*.es.amazonaws.com&quot; end point, I get the following error:

&gt; {&quot;Message&quot;:&quot;User: anonymous is not authorized to perform: es:ESHttpGet on resource: arn:aws:es:us-east-1:[ACCOUNT_ID]:domain/[ES_DOMAIN]/“}

Does anyone know what I have to change in the access policy in order for this to work?

Proper access policy for Amazon Elastic Search Cluster

I am going to create a new distribution at **CloudFront**. Already I have uploaded my SSL certificate at AWS IAM using AWS CLI. That certificate appears in the Custom SSL Certificate dropdown on new distribution page but it is **DISABLED**.

Can someone tell me why is it so ? How to select my custom SSL certificate for this distribution ?

Unable to select Custom SSL Certificate (stored in AWS IAM)

Let me explain my question first. I bought a certificate from a CA and used the following format to generate the csr and the private key:

    openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

When I open the server.key file, I see that it begins with &quot;-----BEGIN PRIVATE KEY-----&quot;

I use the SSL cert on my server and everything looks fine.

Now I want to upload the same cert to AWS IAM so that I can use it for by beanstalk load balancer. I use the following command from this aws doc http://docs.aws.amazon.com/IAM/latest/UserGuide/InstallCert.html#SubmitCSRCertAuth

    iam-servercertupload -b public_key_certificate_file  -k privatekey.pem -s certificate_object_name

I change the cert file names as required but keep getting this error: &quot;400 MalformedCertificate Invalid Private Key.&quot;

The interesting thing is, on the aws doc page, the sample private key that they show starts with &quot;-------Begin RSA Private Key--------&quot;

Is there a way to convert my private key to an RSA private key using openssl?

How to convert a private key to an RSA private key?

I&#39;m adding and removing AWS IAM user policies programmatically, and I&#39;m getting inconsistent results from the application of those policies.

For example, this may or may not succeed (I&#39;m using the Java 1.6.6 SDK):

1. Start with a user that can read from a particular bucket
2. Clear user policies (list policies then call &quot;deleteUserPolicy&quot; for each one)
3. Wait until the user has no user policies (call &quot;listUserPolicies&quot; until it returns an empty set)
4. Attempt to read from the bucket (this should fail)

If I put in a breakpoint between #3 and #4 and wait a few seconds, the user cannot read from the bucket, which is what I expect. If I remove breakpoints, the user can read from the bucket, which is wrong.  

(This is also inconsistent when I **add** a policy then access a resource)

I&#39;d like to know when a policy change has had an effect on the component (S3, SQS, etc), not just on the IAM system. Is there any way to get a receipt or acknowledgement from this? Or maybe there is a certain amount of time to wait?

Is there any documentation on the internals of policy application?

(FYI I&#39;ve copied my question from https://forums.aws.amazon.com/thread.jspa?threadID=140383&amp;tstart=0)

How long should I wait after applying an AWS IAM policy before it is valid?

I&#39;m trying out [Serverless][1] to create AWS Lambdas and while creating a project using the command `serverless project create` I&#39;m getting the following error.

    AccessDenied: User: arn:aws:iam::XXXXXXXXX:user/XXXXXXXXX is not authorized to perform: cloudformation:CreateStack on resource: arn:aws:cloudformation:us-east-1:XXXXXXXXX:stack/XXXXXXXXX-development-r/*

I have created a user and granted the following permissions to the user. 

 1. AWSLambdaFullAccess
 2. AmazonS3FullAccess
 3. CloudFrontFullAccess
 4. AWSCloudFormationReadOnlyAccess ( There was no `AWSCloudFormationFullAccess` to grant )

How can I proceed? What else permissions I have to grant? 

  [1]: http://serverless.com

User is not authorized to perform: cloudformation:CreateStack

When creating a stack with CloudFormation, I get this error:

&gt; Stack update error: Requires capabilities : [CAPABILITY_IAM]

I can&#39;t find a template for adding `CAPABILITIES_IAM` to the CloudFormation configuration.

What are the options for resolving `CAPABILITIES_IAM` errors?

AWS CloudFormation Stack update error: Requires capabilities : [CAPABILITY_IAM]

I am trying out a simple example suggested by AWS documentation to create a role using a policy json file
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html
And I get the error

    A client error (MalformedPolicyDocument) occurred when calling the CreateRole operation: Has prohibited field Resource

Here&#39;s the command,

    &gt;&gt; aws iam create-role --role-name test-service-role --assume-role-policy-document file:///home/ec2-user/policy.json
    A client error (MalformedPolicyDocument) occurred when calling the CreateRole operation: Has prohibited field Resource

The policy is the exact same as the one mentioned in the example

    &gt;&gt; cat policy.json 
    {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: &quot;s3:ListBucket&quot;,
        &quot;Resource&quot;: &quot;arn:aws:s3:::example_bucket&quot;
      }
    }

My version seems to be up to date

    &gt;&gt; aws --version
    aws-cli/1.9.9 Python/2.7.10 Linux/4.1.10-17.31.amzn1.x86_64 botocore/1.3.9

AWS create role - Has prohibited field

I have two AWS account - lets say A and B.

In account B, I have a role defined that allow access to another role from account A. Lets call it Role-B

&lt;!-- language: lang-json --&gt;

    {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
      {
         &quot;Effect&quot;: &quot;Allow&quot;,
         &quot;Principal&quot;: {
             &quot;AWS&quot;: &quot;arn:aws:iam::********:role/RoleA&quot;
         },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }]
    }


In account A, I have defined a role that allows the root user to assume role. Lets call it Role-A

&lt;!-- language: lang-json --&gt;

    {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
      {
         &quot;Effect&quot;: &quot;Allow&quot;,
         &quot;Principal&quot;: {
             &quot;AWS&quot;: &quot;arn:aws:iam::********:root&quot;
         },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }]
    }

Role A has the following policy attached to it

&lt;!-- language: lang-json --&gt;

     {
        &quot;Version&quot;: &quot;2012-10-17&quot;,
        &quot;Statement&quot;: [
            {
                &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
                &quot;Resource&quot;: &quot;arn:aws:iam::****:role/RoleB&quot;,
                &quot;Effect&quot;: &quot;Allow&quot;
           }]
     }

As a user in account A, I assumed the Role-A. Now using this temporary credential, I want to assume the Role-B and access the resource owned by account B. I have the below code

&lt;!-- language: lang-py --&gt;

    client = boto3.client(&#39;sts&#39;)
    
    firewall_role_object = client.assume_role(
        RoleArn=INTERMEDIARY_IAM_ROLE_ARN,
        RoleSessionName=str(&quot;default&quot;),
        DurationSeconds=3600)
     
    firewall_credentials = firewall_role_object[&#39;Credentials&#39;]

    firewall_client = boto3.client(
        &#39;sts&#39;,
        aws_access_key_id=firewall_credentials[&#39;AccessKeyId&#39;],
        aws_secret_access_key=firewall_credentials[&#39;SecretAccessKey&#39;],
        aws_session_token=firewall_credentials[&#39;SessionToken&#39;], )

    optimizely_role_object = firewall_client.assume_role(
        RoleArn=CUSTOMER_IAM_ROLE_ARN,
        RoleSessionName=str(&quot;default&quot;),
        DurationSeconds=3600)

    print(optimizely_role_object[&#39;Credentials&#39;])

This code works for the set of roles I got from my client but is not working for the roles I defined between two of the AWS account I have access to.

How to assume an AWS role from another AWS role?

I am getting an error when calling to `assume role` method of STS. It says that the user is not authorized to perform `sts:AsumeRole` on resource `xxx`.

I did the following:

 1. I created a role to access to S3 bucket.
 2. I ran a test over policy simulator and works fine
 3. I created a new group, and in it, i created a new policy that
    enables all sts actions, over all resources.
 4. I ran a test with the policy simulator, to sts assume role, pointing
    to the ARN of role created at step one; and it works fine
 5. I created a new user, and put it in group created at step 3
 6. With the credentials of the new user, i try to get a new credentials
    using sts asume role, but throw me an error that say my user is not
    authorized to perform sts:AssumeRole

What am I doing wrong?

Policy in Group

    {
        &quot;Version&quot;: &quot;2012-10-17&quot;,
        &quot;Statement&quot;: [
            {
                &quot;Sid&quot;: &quot;some-large-id&quot;,
                &quot;Effect&quot;: &quot;Allow&quot;,
                &quot;Action&quot;: [
                    &quot;sts:*&quot;
                ],
                &quot;Resource&quot;: [
                    &quot;*&quot;
                ]
            }
        ]
    }

Policy in role

    {
        &quot;Version&quot;: &quot;2012-10-17&quot;,
        &quot;Statement&quot;: [
            {
                &quot;Sid&quot;: &quot;another-large-id&quot;,
                &quot;Effect&quot;: &quot;Allow&quot;,
                &quot;Action&quot;: [
                    &quot;s3:PutObject&quot;
                ],
                &quot;Resource&quot;: [
                    &quot;arn:aws:s3:::my-bucket-name/*&quot;
                ]
            }
        ]
    }

And finally calling like this

    let policy = {
    	&quot;Version&quot;: &quot;2012-10-17&quot;,
    	&quot;Statement&quot;: [
    		{
    			&quot;Sid&quot;: &quot;new-custom-id&quot;,
    			&quot;Effect&quot;: &quot;Allow&quot;,
    			&quot;Action&quot;: [&quot;s3:PutObject&quot;],
    			&quot;Resource&quot;: [&quot;arn:aws:s3:::my-bucket-name/*&quot;]
    		}
    	]
    };
    
    let params = {
    	DurationSeconds: 3600, 
    	ExternalId: &#39;some-value&#39;, 
    	Policy: JSON.stringify(policy), 
    	RoleArn: &quot;arn:aws:iam::NUMBER:role/ROLE-NAME&quot;, //Cheked, role is the same that step one
    	RoleSessionName: this.makeNewSessionId()
    };
    let sts = new AWS.STS({ apiVersion: &#39;2012-08-10&#39; });
    
    sts.assumeRole(params, (err, data) =&gt; {
    	if(err) console.log(err);
    	else console.log(data);
    });

How enable access to AWS STS AssumeRole

I am getting an acccess denied error from S3 AWS service on my Lambda function.

This is the code:

    // dependencies
    var async = require(&#39;async&#39;);
    var AWS = require(&#39;aws-sdk&#39;);
    var gm = require(&#39;gm&#39;).subClass({ imageMagick: true }); // Enable ImageMagick integration.
    
    exports.handler = function(event, context) {
        var srcBucket = event.Records[0].s3.bucket.name;
        // Object key may have spaces or unicode non-ASCII characters.
        var key = decodeURIComponent(event.Records[0].s3.object.key.replace(/\+/g, &quot; &quot;));
    /*
    {
        originalFilename: &lt;string&gt;,
        versions: [
            {
                size: &lt;number&gt;,
                crop: [x,y],
                max: [x, y],
                rotate: &lt;number&gt;
            }
        ]
    }*/
        var fileInfo;
        var dstBucket = &quot;xmovo.transformedimages.develop&quot;;
        try {
            //TODO: Decompress and decode the returned value
            fileInfo = JSON.parse(key);
            //download s3File
    
            // get reference to S3 client
            var s3 = new AWS.S3();
    
            // Download the image from S3 into a buffer.
            s3.getObject({
                    Bucket: srcBucket,
                    Key: key
                },
                function (err, response) {
                    if (err) {
                        console.log(&quot;Error getting from s3: &gt;&gt;&gt; &quot; + err + &quot;::: Bucket-Key &gt;&gt;&gt;&quot; + srcBucket + &quot;-&quot; + key + &quot;:::Principal&gt;&gt;&gt;&quot; + event.Records[0].userIdentity.principalId, err.stack);
                        return;
                    }
    
                    // Infer the image type.
                    var img = gm(response.Body);
                    var imageType = null;
                    img.identify(function (err, data) {
                        if (err) {
                            console.log(&quot;Error image type: &gt;&gt;&gt; &quot; + err);
                            deleteFromS3(srcBucket, key);
                            return;
                        }
                        imageType = data.format;
    
                        //foreach of the versions requested
                        async.each(fileInfo.versions, function (currentVersion, callback) {
                            //apply transform
                            async.waterfall([async.apply(transform, response, currentVersion), uploadToS3, callback]);
    
                        }, function (err) {
                            if (err) console.log(&quot;Error on excecution of watefall: &gt;&gt;&gt; &quot; + err);
                            else {
                                //when all done then delete the original image from srcBucket
                                deleteFromS3(srcBucket, key);
                            }
                        });
                    });
                });
        }
        catch (ex){
            context.fail(&quot;exception through: &quot; + ex);
            deleteFromS3(srcBucket, key);
            return;
        }
            function transform(response, version, callback){
                var imageProcess = gm(response.Body);
                if (version.rotate!=0) imageProcess = imageProcess.rotate(&quot;black&quot;,version.rotate);
                if(version.size!=null) {
                    if (version.crop != null) {
                        //crop the image from the coordinates
                        imageProcess=imageProcess.crop(version.size[0], version.size[1], version.crop[0], version.crop[1]);
                    }
                    else {
                        //find the bigger and resize proportioned the other dimension
                        var widthIsMax = version.size[0]&gt;version.size[1];
                        var maxValue = Math.max(version.size[0],version.size[1]);
                        imageProcess=(widthIsMax)?imageProcess.resize(maxValue):imageProcess.resize(null, maxValue);
                    }
                }
    
    
                //finally convert the image to jpg 90%
                imageProcess.toBuffer(&quot;jpg&quot;,{quality:90}, function(err, buffer){
                    if (err) callback(err);
                    callback(null, version, &quot;image/jpeg&quot;, buffer);
                });
    
            }
    
            function deleteFromS3(bucket, filename){
                s3.deleteObject({
                    Bucket: bucket,
                    Key: filename
                });
            }
    
            function uploadToS3(version, contentType, data, callback) {
                // Stream the transformed image to a different S3 bucket.
                var dstKey = fileInfo.originalFilename + &quot;_&quot; + version.size + &quot;.jpg&quot;;
                s3.putObject({
                    Bucket: dstBucket,
                    Key: dstKey,
                    Body: data,
                    ContentType: contentType
                }, callback);
            }
    };


This is the error on Cloudwatch:

    AccessDenied: Access Denied


This is the stack error:

    at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/services/s3.js:329:35)
    
    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20) 
    
    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
    
    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:596:14)
    
    at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:21:10) 
    
    at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12) 
    
    at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10 
    
    at Request.&lt;anonymous&gt; (/var/runtime/node_modules/aws-sdk/lib/request.js:37:9) 
    
    at Request.&lt;anonymous&gt; (/var/runtime/node_modules/aws-sdk/lib/request.js:598:12) 
    
    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18)


Without any other description or info
on S3 bucket permissions allow to everyone put list and delete.

What can I do to access the S3 bucket?

PS: on Lambda event properties the principal is correct and has administrative privileges.

aws lambda function getting access denied when getObject from s3

What is the difference between an IAM role and an IAM user? The [IAM FAQ][1] has an entry explaining it, but it was vague and not very clear:

&gt; An IAM user has permanent long-term credentials and is used to directly interact with AWS services. An IAM role does not have any credentials and cannot make direct requests to AWS services. IAM roles are meant to be assumed by authorized entities, such as IAM users, applications, or an AWS service such as EC2.

I think an IAM role is used for federated logins (using an IdP with SAML tokens for example), and they don&#39;t have permanent access keys that you can download like regular IAM users have (the &quot;an IAM role doesn&#39;t have any credentials&quot; part).

What do they mean when they say an IAM role can&#39;t make direct requests to AWS services? I can login to AWS Console (the web console) and create stacks etc, so it can&#39;t be that.


  [1]: https://aws.amazon.com/iam/faqs/

All Amazon Iam Solutions on Gang of Coders

Total of 23 Amazon Iam Solutions