A scheduled Lambda suddenly gets AccessDenied. What do you investigate first?

Say it in 30 seconds

Say it like this (20-30 seconds)

I capture the failing operation, caller ARN, resource ARN, time and request ID before changing permissions. Then I locate the exact stage: reading S3, decrypting with KMS, fetching a secret or connecting to a database. Recent policy, object-prefix, encryption or credential changes guide the next check. I verify the live policy and relevant audit events; a previously successful run does not prove today’s request uses the same inputs.

The deeper answer

This is an explain-only scheduled-job scenario. MiniTickets has an SQS-driven ticket Lambda, not a scheduled S3-to-database importer. Its role is a concrete least-privilege example: object writes are limited to tickets/*, and secret reads name one signing secret.

For the hypothetical importer, compare yesterday’s successful object with today’s object key, owner and encryption key. An S3 authorization failure and a KMS decrypt denial need different evidence. A database password rejection is another stage entirely; a rotated secret cached by a warm process can explain it without any S3 policy change.

Check identity policies and resource policies, plus any applicable boundary, session policy or organization policy. An explicit deny cannot be repaired by adding another allow. CloudTrail data events require the relevant logging configuration; absence from Event history is not proof that an object request never happened. AWS’s denial guide explains the different policy contexts.

Counter-questions

Would you blame IAM propagation first?

No. First establish that the intended policy is attached live and the failing request matches its action, resource and conditions.

Should you rotate access keys?

A Lambda execution role normally receives temporary credentials automatically. First establish whether the job wrongly uses static credentials; key rotation is not a generic AccessDenied fix.

What if permissions did not change?

Inputs may have changed: another prefix, object owner, KMS key or secret version can cross an existing permission boundary.

Where in MiniTickets

Read the path chapter, select the relevant map piece →, then inspect infra/src/tickets/iam.ts → createTicketRole. Work through the related case for a diagnostic example.