Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 302 discussion

Event Trigger Issue: The Lambda function is not being triggered when objects are created or modified in the S3 bucket. A common reason for this issue is that Amazon S3 does not have the necessary permissions to invoke the Lambda function. Lambda Function Resource Policy: Unlike some AWS services (e.g., SNS, SQS), which can automatically invoke Lambda if they have permissions in their service role, S3 requires an explicit resource-based policy on the Lambda function to grant it invocation permissions. This means S3 needs explicit permission to trigger the Lambda function when events occur. Why Option B Works: Adding a resource-based policy to the Lambda function allows S3 to invoke the function when an event (PUT/POST operation) occurs. The policy should include an "s3.amazonaws.com" principal and an action of "lambda:InvokeFunction", granting S3 the ability to trigger Lambda.

1. S3-to-Lambda Invocation: • When you configure Amazon S3 to trigger an AWS Lambda function, S3 must have explicit permission to invoke the function. This is done by attaching a resource-based policy to the Lambda function. • Without this policy, even if S3 event notifications are configured, the Lambda function will not be triggered because S3 does not have the necessary permissions to invoke the function. 2. Solution Details: • A resource policy for the Lambda function specifies that the S3 bucket is allowed to invoke the Lambda function. This is configured by using the AWS CLI, AWS SDKs, or directly in the AWS Management Console.

Lambda should allow to be invoked by S3 bucket Hence B

https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html The lambda resource policy should allow S3. Or in cloudformation terms: adding the AWS::Lambda::Permission

Event Source Mapping and Permission Requirements: For Amazon S3 to invoke a Lambda function, the Lambda function must have a resource-based policy that grants Amazon S3 permission to invoke it. Without this resource-based policy, even if the event source is correctly configured, the Lambda function will not be triggered because S3 is not authorized to invoke it. Resource Policy for Lambda Function: A resource policy on the Lambda function explicitly allows Amazon S3 to invoke the function for the specified bucket events (e.g., object creation or modification). This resolves the issue by enabling S3 to trigger the Lambda function Action - lambda:InvokeFunction allows S3 to invoke the Lambda function. https://docs.aws.amazon.com/lambda/latest/dg/with-s3.html