S3 イベント通知で Lambda が呼び出されないときは、オートメーションランブックで原因を特定しよう！

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "lambda:GetFunction",
                "s3:ListBucket",
                "s3:GetBucketNotification",
                "lambda:GetPolicy"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "ssm.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

{"Payload":"

+-+-+ AWSSupport-TroubleshootS3Lambda Runbook Report +-+-+

The runbook was executed against following resources:

* Amazon S3 Bucket: XXXXXXXXXX
* AWS Lambda Function: XXXXXXXXXX

Please read each report below and take any action if necessary.

-------------------------------------------------------
  S3 Event Notification Configuration Analysis Result  
-------------------------------------------------------

Event notification configuration found for the AWS Lambda function XXXXXXXXXX as follows:

Configuration ID: s3
---------------
* Events: [\"s3:ObjectCreated:Put\", \"s3:ObjectCreated:Post\"]
* Filter Rules: [{\"Name\": \"Prefix\", \"Value\": \"\"}, {\"Name\": \"Suffix\", \"Value\": \"\"}]

--> No special characters or wildcard character ('*') found in filter rules.

-------------------------------------------------------
    Lambda Function Resource Policy Analysis Result    
-------------------------------------------------------

!!! Action Required !!!
The provided AWS Lambda function 'XXXXXXXXXX' does not have resource policy configured for the Amazon S3 bucket XXXXXXXXXX. Please configure one by following the tutorial below.

- Tutorial: Using an Amazon S3 trigger to invoke a Lambda function
https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example.html

Alternatively, you can configure resource policy by executing the following AWS CLI command.
\```
aws lambda add-permission --function-name arn:aws:lambda:ap-northeast-1:XXXXXXXXXX:function:XXXXXXXXXX --action lambda:InvokeFunction --statement-id XXXXXXXXXX --principal s3.amazonaws.com --source-arn arn:aws:s3:::XXXXXXXXXX --source-account XXXXXXXXXX
\```

"}