<p>This represents a misunderstanding of when Lambda code is loaded.</p>

<p>AWS Lambda does <strong>not</strong> download a copy of the code from S3 every time a function is executed. Instead, Lambda has its own internal storage that is updated when invoking <code>CreateFunction</code> or <code>UpdateFunctionCode</code> either through the API or the Console.</p>

<p><em>Update with further clarification from jdog:</em></p>

<blockquote>
  <p>Lambda is never given access to S3 buckets -- the user or role that runs CreateFunction is.</p>
</blockquote>

CC BY-SA 4.0
2019-03-02T06:29:44.233Z
Still, the question is valid -- even though Lambda only needs to access the deployment package from tbe bucket, once... how is it given permission to do so?  There must be a mechanism, and it is not readily apparent from the `CreateFunction` or `UpdateFunctionCode` documentation, both of which just take bucket, object key, and optionally object version ID.
Michael - sqlbot
CC BY-SA 4.0
2019-03-05T06:06:26.797Z
It is never given access. The user or role that runs CreateFunction is.
jdog
CC BY-SA 4.0
2019-03-02T00:43:53.903Z
2019-03-07T00:16:46.837Z
2019-03-07T00:16:46.837Z
Nic
<p>There doesn't seem to be any way to define a policy about which S3 buckets Lambda is allowed to run code from.</p>

<p>With most services in AWS, the usual practice is to define an IAM role that can be assumed by the AWS service so that it can perform work on user-created resources in the account. For instance, Kinesis Firehose isn't allowed to write into one of your S3 buckets until it's explicitly granted permission with an IAM role.</p>

<p>Even with Lambda we have the concept of an execution role, that is the IAM role that can be used by custom code in our Lambda. But that still takes place <em>after</em> the code has been loaded.</p>

<amazon-web-services><aws-lambda><aws-iam>
Which S3 buckets is Lambda allowed to read code from?
Nic
# Which S3 buckets is Lambda allowed to read code from?

(Asked by: username_0 on 2019-03-02)

There doesn't seem to be any way to define a policy about which S3 buckets Lambda is allowed to run code from.

With most services in AWS, the usual practice is to define an IAM role that can be assumed by the AWS service so that it can perform work on user-created resources in the account. For instance, Kinesis Firehose isn't allowed to write into one of your S3 buckets until it's explicitly granted permission with an IAM role.

Even with Lambda we have the concept of an execution role, that is the IAM role that can be used by custom code in our Lambda. But that still takes place *after* the code has been loaded.

**Tags:** amazon-web-services, aws-lambda, aws-iam


---

## 1 answers

### Answer by username_0 on 2019-03-02. Score: 0 | Accepted answer

This represents a misunderstanding of when Lambda code is loaded.

AWS Lambda does **not** download a copy of the code from S3 every time a function is executed. Instead, Lambda has its own internal storage that is updated when invoking `CreateFunction` or `UpdateFunctionCode` either through the API or the Console.

*Update with further clarification from username_2:*

> Lambda is never given access to S3 buckets -- the user or role that runs CreateFunction is.

> **Comments:**
> **username_1**: Still, the question is valid -- even though Lambda only needs to access the deployment package from tbe bucket, once... how is it given permission to do so?  There must be a mechanism, and it is not readily apparent from the `CreateFunction` or `UpdateFunctionCode` documentation, both of which just take bucket, object key, and optionally object version ID.  
> **username_2**: It is never given access. The user or role that runs CreateFunction is.  

---

