I have an old template for an app i am trying to rebuild in AWS with the similar parameters. I have successfully copied all the files to my account and it works fine till it has to create S3 bucket in which it throws the error - Resource handler returned message:

Unable to validate the following destination configurations (Service: S3, Status Code: 400, Request ID: MV9SQ25WK1ZDNA89, Extended Request ID: tvWAt7vhcOeC1MOr07/wokB/CFwY3WJ+Mh38wgnH5oTHuNJc7Eq+kb/3iiJefRiHKnLQVI7zGpfvq9G0YsARmw==)" (RequestToken: 52421cf8-e91e-f57a-54c4-6d90d8382023, HandlerErrorCode: InvalidRequest)

I have tried to add permission for lambda functions to my bucket policy as well as my IAM user but still getting stuck with the same error.

My template is stuck at this

  #S3 Bucket
  ParamArchiveBucket:
    Type: AWS::S3::Bucket
    Description: "S3 Bucket to store Param archive videos"
    Properties:
      BucketName: !Sub ${ParamBucketName}-${Environment}
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: "s3:ObjectCreated:*"
            Filter:
              S3Key:
                Rules:
                  - Name: "prefix"
                    Value: !Sub ${paramKey}
            Function: !GetAtt LambdaFunctionArchiveParamSession.Arn

I have tried to add permissions and policies as suggested on AWS help desk and from the net but have still not managed to solve the error. Can someone please help me in understanding the error and solving it.

I have an old template for an app i am trying to rebuild in AWS with the similar parameters. I have successfully copied all the files to my account and it works fine till it has to create S3 bucket in which it throws the error - Resource handler returned message:

Unable to validate the following destination configurations (Service: S3, Status Code: 400, Request ID: MV9SQ25WK1ZDNA89, Extended Request ID: tvWAt7vhcOeC1MOr07/wokB/CFwY3WJ+Mh38wgnH5oTHuNJc7Eq+kb/3iiJefRiHKnLQVI7zGpfvq9G0YsARmw==)" (RequestToken: 52421cf8-e91e-f57a-54c4-6d90d8382023, HandlerErrorCode: InvalidRequest)

I have tried to add permission for lambda functions to my bucket policy as well as my IAM user but still getting stuck with the same error.

My template is stuck at this

  #S3 Bucket
  ParamArchiveBucket:
    Type: AWS::S3::Bucket
    Description: "S3 Bucket to store Param archive videos"
    Properties:
      BucketName: !Sub ${ParamBucketName}-${Environment}
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: "s3:ObjectCreated:*"
            Filter:
              S3Key:
                Rules:
                  - Name: "prefix"
                    Value: !Sub ${paramKey}
            Function: !GetAtt LambdaFunctionArchiveParamSession.Arn

I have tried to add permissions and policies as suggested on AWS help desk and from the net but have still not managed to solve the error. Can someone please help me in understanding the error and solving it.

• amazon-web-services
• amazon-s3
• aws-lambda
• aws-cloudformation
• aws-cloudformation-custom-resource

• That probably means S3 isn't allowed to invoke the Lambda function, if that's part of the template, please add it to your question. – Maurice Commented Nov 20, 2024 at 15:10
• 1 This question is similar to: S3 Bucket Lambda Event: Unable to validate the following destination configurations. If you believe it’s different, please edit the question, make it clear how it’s different and/or how the answers on that question are not helpful for your problem. – Caldazar Commented Nov 20, 2024 at 15:47

1 Answer 1

You need to ensure that the IAM role associated with the Lambda function has the necessary permissions to be invoked by the S3 bucket

Add the following policy to the Lambda function’s execution role:

{
  "Effect": "Allow",
  "Action": "lambda:InvokeFunction",
  "Resource": "arn:aws:lambda:<Region>:<Account-ID>:function:<FunctionName>"
}

Add a AWS::Lambda::Permission resource to explicitly allow the S3 bucket to invoke the Lambda function:

LambdaInvokePermission:
  Type: AWS::Lambda::Permission
  Properties:
    FunctionName: !GetAtt LambdaFunctionArchiveParamSession.Arn
    Action: "lambda:InvokeFunction"
    Principal: "s3.amazonaws"
    SourceArn: !Sub "arn:aws:s3:::${ParamBucketName}-${Environment}"