amazon web services - Lambda S3 permission denied in s3-get-object blueprint -

i'm trying lambda read file off s3 bucket using s3-get-object blueprint in response file post events.

even when bucket has full public access , full permissions:

{ "version": "2012-10-17", "id": "policy1468930000031", "statement": [     {         "sid": "stmt1468929998580",         "effect": "allow",         "principal": "*",         "action": "s3:*",         "resource": "arn:aws:s3:::xlp-uploads/*"     }   ] } 

and lambda role has full s3 , lambda access, still access denied when running example code.

this lambda code in blueprint:

'use strict'; console.log('loading function');  let aws = require('aws-sdk'); let s3 = new aws.s3({ apiversion: '2006-03-01' });  exports.handler = (event, context, callback) => {     //console.log('received event:', json.stringify(event, null, 2));      // object event , show content type     const bucket = event.records[0].s3.bucket.name;     const key = decodeuricomponent(event.records[0].s3.object.key.replace(/\+/g, ' '));     const params = {         bucket: bucket,         key: key     };     s3.getobject(params, (err, data) => {         if (err) {             console.log(err);             const message = `error getting object ${key} bucket ${bucket}. make sure exist , bucket in same region function.`;             console.log(message);             callback(message);         } else {             console.log('content type:', data.contenttype);             callback(null, data.contenttype);         }     }); }; 

and error is:

{ [accessdenied: access denied]   message: 'access denied',   code: 'accessdenied',   region: null,   time: tue jul 19 2016 12:27:28 gmt+0000 (utc), 

i figured issue out.

i tried post file s3 using rest api file ends in bucket no permissions , not inherit bucket's permissions.

i switched post request accepts acl parameters , gives file permissions in place.