Permissions on resources defined in cloudformation-CodePudding

I am making a cloudformation template to create a lambda with its permissions. I need to access a specific s3 bucket and I am placing its specific arn, however when I execute the lambda it tells me that it does not have permission to access that bucket (getObject), but if I put the almost full name of the s3 arn only that I put a * at the end, if it lets me access the files in that bucket.

Bucket name: bucket-test-impl

LambdaSSMPermissions:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: allowSsmS3
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:PutParameters
                  - ssm:PutParameter
                  - s3:GetObject
                Resource:
                  - arn:aws:s3:::bucket-test-* //THIS WORKS
                  - arn:aws:s3:::bucket-test-impl //IT DOESN'T WORK AND IT'S THE ONE I NEED, 
                  - !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/abcd/*/*'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

CodePudding user response：

To access s3 bucket you have to provide /* at the end of path.

change

arn:aws:s3:::bucket-test-impl

arn:aws:s3:::bucket-test-impl/*

CodePudding user response：

In the end I was able to remove all references with * using the reading policy that Amazon gives me.

ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'

With this, I was able to use the direct arn of the file inside the bucket, without using *

Resource:
       - arn:aws:s3:::bucket-test-impl

or:

Resource:
       - arn:aws:s3:::bucket-test-impl/fileName