Amazon Web Services (AWS)

Identity and Access Management (IAM)

Read and write access to a set of buckets matching a pattern, and nothing else. The two statements are deliberate: ListBucket acts on the bucket ARN, GetObject/PutObject act on the object ARNs under it. Putting them together in one statement is the usual reason a policy looks right and denies everything.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::some-buckets-*-dev"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::some-buckets-*-dev/*"
            ]
        }
    ]
}

"Version": "2012-10-17" is not a date to update - it is the policy language version, and it is still the current one.

Lambda

The deployment tooling this page used to list has aged out. kappa has not moved since 2021, and the rest of it predated AWS shipping its own answers: SAM, CDK and container image support cover what those tools were for.

• AWS Lambda blog posts - the release feed, and the only link here that stays current on its own.
• node-lambda - still maintained, if you want a small deploy tool rather than a framework. Note it moved from the rebelmail org.