How to Add iamRoleStatements to S3 Trigger Bucket in Serverless Framework

Question

When I am adding the following code in serverless.yml file

provider:
  name: aws
  runtime: python3.6
  stage: dev
  region: [REGION]
  iamRoleStatements:
    - Effect: "Allow"
      Action:
       - "s3:GetObject"
      Resource: { "Fn::Join": ["", ["arn:aws:s3:::", { "Ref": [BUCKET NAME] }, "/*" ] ] }

On deployment, I am getting “The CloudFormation template is invalid: Circular dependency between resources:”

I am using boto3 with python3 to get the private file that is uploaded to the S3 bucket after the trigger event so like to give the permission to Lambda function for that bucket.

Answer 1

I have encountered the same issue and I spent hours on it. Finally I found a solution: do NOT ref the bucket.

Change

provider:
  name: aws
  runtime: python3.6
  stage: dev
  region: [REGION]
  iamRoleStatements:
    - Effect: "Allow"
      Action:
       - "s3:GetObject"
      Resource: { "Fn::Join": ["", ["arn:aws:s3:::", { "Ref": [BUCKET NAME] }, "/*" ] ] }

to

provider:
  name: aws
  runtime: python3.6
  stage: dev
  region: [REGION]
  iamRoleStatements:
    - Effect: "Allow"
      Action:
       - "s3:GetObject"
      Resource: { "Fn::Join": ["", ["arn:aws:s3:::<s3-bucket-name>", "/*" ] ] }

Or even simpler:

provider:
  name: aws
  runtime: python3.6
  stage: dev
  region: [REGION]
  iamRoleStatements:
    - Effect: "Allow"
      Action:
       - "s3:GetObject"
      Resource: "arn:aws:s3:::<s3-bucket-name>/*"