AWS Lambda S3 Access Denied

Question

I have a lambda function using a role with the following policy excerpt

{
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::ipwl-lambda-config/*",
                "arn:aws:s3:::ipwl-lambda-config"
            ]
        }

My bucket policy looks like the following

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyUnEncryptedObjectUploads",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::ipwl-lambda-config/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "aws:kms"
                }
            }
        },
        {
            "Sid": "AllowLambda",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::accountid:role/iam_for_lambda"
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::ipwl-lambda-config/*",
                "arn:aws:s3:::ipwl-lambda-config"
            ]
        }
    ]
}

I've allowed GetObject and ListBucket on both the role and the bucket policy. However when my function runs

s3_obj = s3_res.Object(s3_bucket, s3_object)

I get

[ERROR] ClientError: An error occurred (AccessDenied) when calling the GetObject operation: Access Denied

What more permissions do I have to add? The object is there, I can get it when I run the code locally using an admin role.

Update

I've checked to make sure the bucket and object names are correct dozens of times. The exception is actually coming from the second line here according to the stacktrace

s3_res = boto3.resource('s3')
s3_obj = s3_res.Object(s3_bucket, s3_object)
data = s3_obj.get()['Body'].read()

KMS should only be a factor for PutObject. We have a support account so I may check with them and update with their findings.

Answer 1

To download a KMS-encrypted object from S3, you not only need to be able to get the object. You also need to be able to decrypt the AWS KMS key.

Here's an example of an IAM policy that your Lambda function should have:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "s3get",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::ipwl-lambda-config/*"
    },
    {
      "Sid": "kmsdecrypt",
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:example-region-1:123456789012:key/example-key-id"
    }
  ]
}

The key policy also needs to allow the IAM role to decrypt the key, something like this:

{
  "Sid": "kmsdecrypt",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:role/xyz"
  },
  "Action": "kms:Decrypt",
  "Resource": "*"
}