AWS Lambda Error - The provided execution role does not have permissions to call PutObject on S3

#aws#lambda#devops#cloud

This error means Lambda was not allowed to write to the S3 bucket.

Problem

Your Lambda function attempts to write an object to Amazon S3 and fails with an error similar to:

An error occurred (AccessDenied) when calling the PutObject operation: 
The provided execution role does not have permissions to call PutObject on S3

Lambda cannot complete the S3 write operation because its execution role is missing the correct IAM permissions.

---

Clarifying the Issue

This error occurs when the Lambda execution role lacks permission to run s3:PutObject on the target bucket. Even if your AWS CLI user has full access, Lambda only uses the permissions attached to its execution role. This is not a bucket misconfiguration, not a networking issue, and not related to dependencies. It is strictly an IAM permissions issue.

---

Why It Matters

When Lambda cannot write to S3, workflows break immediately. Common failure points include:

• API Gateway → Lambda → S3 upload pipelines
• Data ingestion jobs
• File processing workflows
• Event-driven pipelines where Lambda writes logs or results

Your function may appear healthy, but without the correct S3 permissions, it will fail at runtime.

---

Key Terms

• Execution Role: The IAM role Lambda assumes during execution.
• s3:PutObject: The S3 API action required to upload or write an object.
• Bucket Policy: Optional access control that may also restrict uploads.
• Resource ARN: The S3 bucket or object path that permissions apply to.

---

Steps at a Glance

1. Identify the S3 bucket and prefix Lambda is writing to.
2. Check CloudWatch Logs to confirm the AccessDenied error.
3. Add s3:PutObject permission to the Lambda execution role.
4. Ensure the IAM policy targets the correct bucket ARN.
5. (Optional) Update the S3 bucket policy to allow the Lambda role.
6. Test the function and confirm the S3 write succeeds.

---

Step 1: Identify the S3 bucket and prefix Lambda is writing to

Review your code to determine the bucket and path.

Example:

s3.put_object(
    Bucket="my-app-bucket",
    Key=f"reports/{filename}",
    Body=data
)

This tells you:

• Bucket: my-app-bucket
• Prefix: reports/

You need accurate values for both.

---

Step 2: Check CloudWatch Logs to confirm the AccessDenied error

Open CloudWatch Logs and look for:

botocore.exceptions.ClientError: 
An error occurred (AccessDenied) when calling the PutObject operation:

This verifies the issue is permissions-related.

---

Step 3: Add s3:PutObject permission to the Lambda execution role

Attach the following IAM policy to the Lambda execution role:

{
  "Effect": "Allow",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::my-app-bucket/reports/*"
}

For writing anywhere in the bucket, use:

arn:aws:s3:::my-app-bucket/*

Attach the policy to the role listed under the Lambda function's Permissions tab.

---

Step 4: Ensure the IAM policy targets the correct bucket ARN

Correct ARNs:

arn:aws:s3:::my-app-bucket/* ✅
arn:aws:s3:::my-app-bucket/reports/* ✅

Incorrect:

arn:aws:s3:::my-app-bucket ❌

The incorrect version grants bucket-level permissions only, not object-level write access.

---

Step 5: (Optional) Update the S3 bucket policy to allow the Lambda role

Some buckets require explicit allow statements.

Example bucket policy:

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:role/MyLambdaExecutionRole"
  },
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::my-app-bucket/*"
}

This is necessary if the bucket enforces strict access controls.

---

Step 6: Test the function and confirm the S3 write succeeds

Invoke the function:

aws lambda invoke \
  --function-name MyFunction \
  response.json

cat response.json

Then verify that the file appears in the S3 bucket.

If the upload still fails, check:

• The Lambda uses the updated execution role.
• The IAM policy prefix matches your S3 Key.
• No Deny statements exist in the bucket policy.

---

Pro Tips

• Lambda needs object-level permissions for writes.
• Avoid Resource: * unless testing.
• Binary data uploads require correct encoding, but this does not affect permissions.
• For multiple Lambdas writing to the same bucket, consider a shared managed policy.

---

Conclusion

This error means Lambda was not allowed to write to the S3 bucket. By granting s3:PutObject on the correct bucket ARN and adjusting the bucket policy if needed, you restore full functionality. Once permissions are correct, the entire pipeline becomes stable and predictable.

---

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.