Can't add s3 notification for lambda using boto3

Question

I want to use boto3 to configure an s3 bucket to invoke an AWS lambda every time an object is created in that bucket. Here is my code:

s3 = ..boto3 resource
bucket_notification = s3.BucketNotification(bucket_name)
lambda_arn = .. arn for lambda

response = bucket_notification.put(
   NotificationConfiguration={'LambdaFunctionConfigurations': [
      {
                'LambdaFunctionArn': lambda_arn,
                'Events': [
                    's3:ObjectCreated:*'
                ],

      },
]})

I get the error:

botocore.exceptions.ClientError: An error occurred (InvalidArgument) when calling the PutBucketNotificationConfiguration operation: Unable to validate the following destination configurations

Solution

One has to add permissions on the lambda end to allow S3 to invoke the lambda function. Beware, if you manually create the event source mapping using the AWS Lambda GUI and then delete the event source mapping, the permission still exists! So you won't get the above error.

However, if you start from scratch and then try to add the notification, the above error will occur.

Permissions are added by:

 client = ...boto3 lambda client
 response = client.add_permission(
     FunctionName=lambda_name,
     StatementId='1',
     Action='lambda:InvokeFunction',
     Principal='s3.amazonaws.com',
     SourceArn=s3_arn,
     SourceAccount='66666666666'
 )

Comments

[Lee Netherton]

Thanks. This saved me a lot of headache. Also, if you are using CloudFormation to deploy your lambda function, then you can add the required permission straight from the template: docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/…

[3cheesewheel]

+1 for this. Ran into the same issue trying to add an s3 notification for an SQS queue; it started working after I added the right permissions/policy on the SQS end.