title: Access Denied when trying to PutObject to s3
body: <p>I'm using the Serverless Framework to create a lambda that saves a CSV to a S3 bucket.</p>
  <p>I already have a similar lambda that does this with another bucket.</p>
  <p>This is where it gets weird: I can upload the CSV to the first S3 bucket I created (many months back), but I'm getting an AccessDenied error when uploading the same CSV to the new S3 bucket which was, as far as I can tell, created in the exact same way as the first via the serverless.yml config.</p>
  <p>The error is:</p>
  <pre><code>Error: AccessDenied: Access Denied
  </code></pre>
  <p>These are the relevant bits from the serverless.yml:</p>
  <pre><code>provider:
    name: aws
    runtime: nodejs12.x
    stage: ${opt:stage, 'dev'}
    region: eu-west-1
    environment:
      BUCKET_NEW: ${self:custom.bucketNew}
      BUCKET: ${self:custom.bucket}
  
    iam:
      role:
        statements:
          - Effect: 'Allow'
            Action: 'lambda:InvokeFunction'
            Resource: '*'
          - Effect: 'Allow'
            Action:
              - 's3:GetObject'
              - 's3:PutObject'
            Resource:
              - 'arn:aws:s3:::*' # Added this whilst debugging
              - 'arn:aws:s3:::*/*' # Added this whilst debugging
              - 'arn:aws:s3:::${self:custom.bucket}'
              - 'arn:aws:s3:::${self:custom.bucket}/*'
              - 'arn:aws:s3:::${self:custom.bucketNew}'
              - 'arn:aws:s3:::${self:custom.bucketNew}/*'
  
  functions:
    uploadReport:
      handler: services/uploadReport.handler
      vpc:
        securityGroupIds:
          - 000001
        subnetIds:
          - subnet-00000A
          - subnet-00000B
          - subnet-00000C
  
  resources:
    Resources:
      Bucket:
        Type: 'AWS::S3::Bucket'
        Properties:
          BucketName: ${self:custom.bucket}
      BucketNew:
        Type: 'AWS::S3::Bucket'
        Properties:
          BucketName: ${self:custom.bucketNew}
  
  custom:
    stage: ${opt:stage, 'dev'}
    bucket: ${self:service}-${self:custom.stage}-report
    bucketNew: ${self:service}-${self:custom.stage}-report-new
  </code></pre>
  <p>Lambda code (simplified):</p>
  <pre><code>const fs = require('fs')
  const AWS = require('aws-sdk')
  
  const S3 = new AWS.S3({
    httpOptions: {
      connectTimeout: 1000,
    },
  })
  
  
  const uploadToS3 = (params) =&gt; new Promise((resolve, reject) =&gt; {
    S3.putObject(params, err =&gt; (err ? reject(err) : resolve(params.Key)))
  })
  
  module.exports.handler = async () =&gt; {
    const fileName = `report-new.csv`
    const filePath = `/tmp/${fileName}`
  
    // Some code that creates a CSV file at filePath.
  
    const bucketParams = {
      Bucket: process.env.BUCKET_NEW, // Works for process.env.BUCKET, but not process.env.BUCKET_NEW.
      Key: fileName,
      Body: fs.readFileSync(filePath).toString('utf-8'),
    }
  
    try {
      const s3Upload = await uploadToS3(bucketParams)
    } catch (e) {
      throw new Error(e) // Throws Error: AccessDenied: Access Denied.
    }
  }
  </code></pre>