title: Restricting S3 bucket access to an AWS Lambda function
body: <p>I have a file in an S3 bucket for which I would like to restrict access, so that it can only be accessed from within a specific Lambda function. I tried writing a Bucket policy (subbing in my info for region, account, etc.) to accomplish this:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "Stmt1457474835965",
        "Action": "s3:*",
        "Principal": "*",
        "Effect": "Deny",
        "Resource": "arn:aws:s3:::my-bucket/file.txt",
        "Condition": {
          "ArnNotEquals": {
            "aws:SourceArn": "arn:aws:lambda:region:account:function:FunctionName"
          }
        }
      }
    ]
  }
  </code></pre>
  
  <p>However access to the file was still denied to the Lambda function when it was invoked. How can I accomplish what I am trying to do?</p>