Lambda with S3 event triggers in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when an S3 event triggers a Lambda function?

An S3 bucket is configured to trigger a Lambda function on object creation. What is the expected behavior when a new file is uploaded?

A The S3 bucket sends an email notification instead of triggering Lambda.

B The Lambda function runs only if the file is larger than 1 GB.

C The Lambda function must be manually invoked after the file upload.

D The Lambda function runs automatically with event details about the new file.

💡 Hint

Think about how event-driven services work in AWS.

When an S3 event trigger is set, Lambda automatically runs with details of the event, such as the file uploaded.

❓ Configuration

intermediate

Which IAM permission is required for Lambda to read an S3 object?

You want your Lambda function to read files from an S3 bucket when triggered. Which IAM permission must be included in the Lambda execution role?

A "s3:GetObject" permission on the bucket

B "s3:PutObject" permission on the bucket

C "s3:DeleteObject" permission on the bucket

D "lambda:InvokeFunction" permission on the bucket

💡 Hint

Consider what action Lambda needs to do to read a file.

To read files from S3, Lambda needs the "s3:GetObject" permission on the bucket or objects.

❓ Architecture

advanced

How to design a fault-tolerant Lambda triggered by S3 events?

You want to ensure your Lambda function processes every S3 upload event even if it fails initially. Which architecture best supports this?

A Use S3 event to trigger Lambda without retries or error handling.

B Set Lambda timeout to 1 second and ignore failures.

C Configure S3 event to trigger Lambda with a dead-letter queue (DLQ) for failed events.

D Manually re-upload files if Lambda fails to process them.

💡 Hint

Think about how to handle failures automatically.

Using a DLQ allows failed Lambda invocations to be captured and retried or inspected later, improving fault tolerance.

❓ security

advanced

What is the safest way to restrict Lambda access to only one S3 bucket?

You want your Lambda function to access only a specific S3 bucket and no others. Which IAM policy condition achieves this?

A Use a policy with "Resource" set to the specific bucket ARN and "Action" to "s3:GetObject".

B Grant "s3:*" permission on all buckets and rely on Lambda code to check bucket name.

C Attach a policy allowing "s3:GetObject" on "arn:aws:s3:::*" (all buckets).

D Use a policy with "Condition" to allow access only during business hours.

💡 Hint

Restrict permissions by resource ARN rather than broad access.

Limiting the IAM policy "Resource" to the specific bucket ARN restricts Lambda access to only that bucket.

✅ Best Practice

expert

How to optimize Lambda cold start time when triggered by S3 events?

Your Lambda function triggered by S3 events has high cold start latency. Which approach best reduces this delay?

A Increase Lambda memory to maximum without testing impact.

B Use provisioned concurrency to keep Lambda instances warm.

C Disable S3 event triggers and invoke Lambda manually.

D Use a larger S3 bucket to speed up event delivery.

💡 Hint

Think about how to keep Lambda ready to run instantly.

Provisioned concurrency keeps Lambda instances initialized and ready, reducing cold start latency significantly.

Practice

1. What happens when you configure an AWS Lambda function with an S3 event trigger for object creation?

easy

A. The Lambda function runs manually and is not triggered by S3 events.

B. The Lambda function runs only when the S3 bucket is deleted.

C. The Lambda function runs automatically whenever a new file is uploaded to the S3 bucket.

D. The Lambda function runs only when an object is deleted from the S3 bucket.

Solution

1. Step 1: Understand S3 event triggers

   S3 event triggers can invoke Lambda functions automatically on specific events like object creation.

2. Step 2: Identify the event type for object creation

   When a new file is uploaded, the event type is 'ObjectCreated', which triggers the Lambda function.

3. Final Answer:

   The Lambda function runs automatically whenever a new file is uploaded to the S3 bucket. -> Option C

4. Quick Check:

   S3 ObjectCreated event triggers Lambda automatically [OK]

Hint: Remember: S3 triggers Lambda on file uploads automatically [OK]

Common Mistakes:

• Confusing object deletion with creation events
• Thinking Lambda runs manually without triggers
• Assuming triggers only work on bucket deletion

2. Which of the following is the correct JSON snippet to configure an S3 event trigger for a Lambda function on object creation?

easy

A. { "Events": ["s3:ObjectCreated:*"], "LambdaFunctionArn": "arn:aws:lambda:region:account-id:function:myFunction" }

B. { "Events": ["s3:ObjectRemoved:*"], "LambdaFunctionArn": "arn:aws:lambda:region:account-id:function:myFunction" }

C. { "Events": ["lambda:InvokeFunction"], "LambdaFunctionArn": "arn:aws:s3:::myBucket" }

D. { "Events": ["s3:ObjectCreated:Delete"], "LambdaFunctionArn": "arn:aws:lambda:region:account-id:function:myFunction" }

Solution

1. Step 1: Identify correct event type for object creation

   The event type for object creation is "s3:ObjectCreated:*" which covers all create events.

2. Step 2: Check Lambda function ARN placement

   The LambdaFunctionArn must point to the Lambda function's ARN, not the bucket ARN.

3. Final Answer:

   { "Events": ["s3:ObjectCreated:*"], "LambdaFunctionArn": "arn:aws:lambda:region:account-id:function:myFunction" } -> Option A

4. Quick Check:

   Use "s3:ObjectCreated:*" for creation triggers [OK]

Hint: Use "s3:ObjectCreated:*" for all object creation events [OK]

Common Mistakes:

• Using ObjectRemoved event instead of ObjectCreated
• Putting bucket ARN instead of Lambda ARN
• Using invalid event names like ObjectCreated:Delete

3. Given this Lambda function code triggered by S3 object creation:

def lambda_handler(event, context):
    bucket = event['Records'][0]['s3']['bucket']['name']
    key = event['Records'][0]['s3']['object']['key']
    return f"File {key} uploaded to {bucket}"

What will be the output if a file named 'photo.jpg' is uploaded to bucket 'my-images'?

medium

A. "File uploaded to my-images"

B. "File photo.jpg uploaded to my-images"

C. "File my-images uploaded to photo.jpg"

D. Runtime error due to missing event keys

Solution

1. Step 1: Extract bucket and key from event

   The code accesses event['Records'][0]['s3']['bucket']['name'] as bucket name and event['Records'][0]['s3']['object']['key'] as file key.

2. Step 2: Substitute values from the upload event

   For file 'photo.jpg' uploaded to 'my-images', bucket='my-images' and key='photo.jpg'.

3. Final Answer:

   "File photo.jpg uploaded to my-images" -> Option B

4. Quick Check:

   Event keys map file and bucket correctly [OK]

Hint: Check event['Records'][0]['s3'] keys for bucket and object [OK]

Common Mistakes:

• Mixing bucket name and object key positions
• Assuming event keys are missing causing errors
• Confusing string formatting output

4. You configured an S3 bucket to trigger a Lambda function on object creation, but the Lambda is not invoked. What is the most likely cause?

medium

A. The S3 bucket notification configuration is missing permission for S3 to invoke Lambda.

B. The S3 bucket is in a different AWS region than the Lambda function.

C. The Lambda function code has a syntax error.

D. The Lambda function's execution role lacks permission to read from S3.

Solution

1. Step 1: Check permissions for S3 to invoke Lambda

   S3 must have permission to invoke the Lambda function via a resource-based policy on Lambda.

2. Step 2: Understand common misconfigurations

   Missing this permission causes Lambda not to trigger even if bucket notifications are set.

3. Final Answer:

   The S3 bucket notification configuration is missing permission for S3 to invoke Lambda. -> Option A

4. Quick Check:

   S3 needs invoke permission on Lambda [OK]

Hint: Grant S3 permission to invoke Lambda in Lambda's resource policy [OK]

Common Mistakes:

• Confusing Lambda execution role with S3 invoke permission
• Assuming code errors prevent invocation
• Thinking region mismatch blocks invocation

5. You want a Lambda function to process only PNG files uploaded to an S3 bucket. How should you configure the S3 event trigger to achieve this?

hard

A. Set the event type to 's3:ObjectCreated:Put' without any filters.

B. Set the event type to 's3:ObjectRemoved:*' and add a prefix filter '.png'.

C. Configure the Lambda function code to ignore non-PNG files without using filters.

D. Set the event type to 's3:ObjectCreated:*' and add a filter with suffix '.png' in the bucket notification configuration.

Solution

1. Step 1: Use event type for object creation

   Use 's3:ObjectCreated:*' to capture all create events including uploads.

2. Step 2: Apply suffix filter for '.png'

   Configure the bucket notification with a filter to trigger Lambda only for files ending with '.png'.

3. Final Answer:

   Set the event type to 's3:ObjectCreated:*' and add a filter with suffix '.png' in the bucket notification configuration. -> Option D

4. Quick Check:

   Use event filters to limit Lambda triggers by file type [OK]

Hint: Use suffix filter '.png' in S3 event trigger for file type filtering [OK]

Common Mistakes:

• Using ObjectRemoved event instead of ObjectCreated
• Relying only on Lambda code filtering without event filters
• Using prefix filter with file extension instead of suffix