title: Why does S3 bucket created in terraform needs bucket policy to grant access to lambda
body: <p>We use a combination of cloud formation and terraform where some common resources like DynamoDB, S3 are created using terraform and others like APIGateway are created using serverless and cloudformation. All resources are in the same AWS account</p>
  
  <p>I have an S3 bucket in terraform</p>
  
  <pre><code>resource "aws_s3_bucket" "payment_bucket" {
    bucket = "payment-bucket-${var.env_name}"
    acl    = "private"
  
    tags = merge(
      module.tags.base_tags,
      {
        "Name" = "payment-bucket-${var.env_name}"
      }
    )
  
    lifecycle {
      ignore_changes = [tags]
    }
  }
  </code></pre>
  
  <p>This creates a private bucket <code>payment-bucket-dev</code> in my AWS account when I run the tf-apply</p>
  
  <p>We have an APIGateway in the same AWS account which is created using serverless and one of the lambda needs accesses to this bucket so I have created an IAM role for the lambda function to grant permission to access the bucket.</p>
  
  <pre><code>  makePayment:
      name: makePayment-${self:provider.stage}
      handler: src/handler/makePayment.default
      events:
        - http:
            path: /payment
            method: post
            private: true
            cors: true
      iamRoleStatementsName: ${self:service}-${self:provider.stage}-makePayment-role
      iamRoleStatements:
        - Effect: Allow
          Action:
            - s3:PutObject
          Resource:
            - arn:aws:s3:::#{AWS::Region}:#{AWS::AccountId}:payment-bucket-${self:provider.stage}/capture/batch/*
  
  </code></pre>
  
  <p>But when I run this lambda <code>make-payment-dev</code> , it throws an AccessDenied error unless I add bucket policy granting access to the lambda role</p>
  
  <pre><code>resource "aws_s3_bucket_policy" "payment_service_s3_bucket_policy" { 
  ..
  ..
  }
  </code></pre>
  
  <p>Why do I need to add S3 bucket policy when both s3 bucket and the lambda function and role are in the same account? Am I missing something?</p>
  
  <p>Also, If I created the bucket using <code>AWS::S3::Bucket</code> as part of the cloud formation stack the Apigateway is in (we are using serverless), I don't need add bucket policy and it all works fine.</p>