Prerequisites Step 1: Create an S3 bucket Step 2: Upload a file to the S3 bucket Step 3: Create an S3 access point Step 4: Create a Lambda function Step 5: Configure an IAM policy for your Lambda function's execution role Step 6: Create an S3 Object Lambda Access Point Step 7: View the transformed data Step 8: Clean up Next steps

Tutorial: Transforming data for your application with S3 Object Lambda

Note

As of November 7th, 2025, S3 Object Lambda is available only to existing customers that are currently using the service as well as to select AWS Partner Network (APN) partners. For capabilities similar to S3 Object Lambda, learn more here - Amazon S3 Object Lambda availability change.

When you store data in Amazon S3, you can easily share it for use by multiple applications. However, each application might have unique data format requirements, and might need modification or processing of your data for a specific use case. For example, a dataset created by an ecommerce application might include personally identifiable information (PII). When the same data is processed for analytics, this PII is not needed and should be redacted. However, if the same dataset is used for a marketing campaign, you might need to enrich the data with additional details, such as information from the customer loyalty database.

With S3 Object Lambda, you can add your own code to process data retrieved from S3 before returning it to an application. Specifically, you can configure an AWS Lambda function and attach it to an S3 Object Lambda Access Point. When an application sends standard S3 GET requests through the S3 Object Lambda Access Point, the specified Lambda function is invoked to process any data retrieved from the underlying data source through the supporting S3 access point. Then, the S3 Object Lambda Access Point returns the transformed result back to the application. You can author and execute your own custom Lambda functions, tailoring the S3 Object Lambda data transformation to your specific use case, all with no changes required to your applications.

This is an S3 Object Lambda workflow diagram.

Objective

In this tutorial, you learn how to add custom code to standard S3 GET requests to modify the requested object retrieved from S3 so that the object suit the needs of the requesting client or application. Specifically, you learn how to transform all the text in the original object stored in an S3 bucket to uppercase through S3 Object Lambda.

Note

This tutorial uses Python code to transform the data, for examples using other AWS SDKs see Transform data for your application with S3 Object Lambda in the AWS SDK Code Examples Library.

Topics

Prerequisites
Step 1: Create an S3 bucket
Step 2: Upload a file to the S3 bucket
Step 3: Create an S3 access point
Step 4: Create a Lambda function
Step 5: Configure an IAM policy for your Lambda function's execution role
Step 6: Create an S3 Object Lambda Access Point
Step 7: View the transformed data
Step 8: Clean up
Next steps

Prerequisites

Before you start this tutorial, you must have an AWS account that you can sign in to as an AWS Identity and Access Management (IAM) user with correct permissions. You also must install Python version 3.8 or later.

Substeps

Create an IAM user with permissions in your AWS account (console)
Install Python 3.8 or later on your local machine

Create an IAM user with permissions in your AWS account (console)

You can create an IAM user for the tutorial. To complete this tutorial, your IAM user must attach the following IAM policies to access relevant AWS resources and perform specific actions. For more information about how to create an IAM user, see Creating IAM users (console) in the IAM User Guide.

Your IAM user requires the following policies:

AmazonS3FullAccess – Grants permissions to all Amazon S3 actions, including permissions to create and use an Object Lambda Access Point.
AWSLambda_FullAccess – Grants permissions to all Lambda actions.
IAMFullAccess – Grants permissions to all IAM actions.
IAMAccessAnalyzerReadOnlyAccess – Grants permissions to read all access information provided by IAM Access Analyzer.
CloudWatchLogsFullAccess – Grants full access to CloudWatch Logs.

Note

For simplicity, this tutorial creates and uses an IAM user. After completing this tutorial, remember to Delete the IAM user. For production use, we recommend that you follow the Security best practices in IAM in the IAM User Guide. A best practice requires human users to use federation with an identity provider to access AWS with temporary credentials. Another best practice is to require workloads to use temporary credentials with IAM roles to access AWS. To learn about using AWS IAM Identity Center to create users with temporary credentials, see Getting started in the AWS IAM Identity Center User Guide.

This tutorial also uses full-access AWS managed policies. For production use, we recommend that you instead grant only the minimum permissions necessary for your use case, in accordance with security best practices.

Install Python 3.8 or later on your local machine

Use the following procedure to install Python 3.8 or later on your local machine. For more installation instructions, see the Downloading Python page in the Python Beginners Guide.

Open your local terminal or shell and run the following command to determine whether Python is already installed, and if so, which version is installed.
```
python --version
```
If you don't have Python 3.8 or later, download the official installer of Python 3.8 or later that's suitable for your local machine.
Run the installer by double-clicking the downloaded file, and follow the steps to complete the installation.

For Windows users, choose Add Python 3.X to PATH in the installation wizard before choosing Install Now.
Restart your terminal by closing and reopening it.
Run the following command to verify that Python 3.8 or later is installed correctly.

For macOS users, run this command:
```
python3 --version
```
For Windows users, run this command:
```
python --version
```
Run the following command to verify that the pip3 package manager is installed. If you see a pip version number and python 3.8 or later in the command response, that means the pip3 package manager is installed successfully.
```
pip --version
```

Step 1: Create an S3 bucket

Create a bucket to store the original data that you plan to transform.

Note

Access points may be attached for another data source, such as an Amazon FSx for OpenZFS volume, however this tutorial uses a supporting access point attached to an S3 bucket.

To create a bucket

Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.
In the left navigation pane, choose Buckets.
Choose Create bucket.

The Create bucket page opens.
For Bucket name, enter a name (for example, tutorial-bucket) for your bucket.

For more information about naming buckets in Amazon S3, see General purpose bucket naming rules.
For Region, choose the AWS Region where you want the bucket to reside.

For more information about the bucket Region, see General purpose buckets overview.
For Block Public Access settings for this bucket, keep the default settings (Block all public access is enabled).

We recommend that you keep all Block Public Access settings enabled unless you need to turn off one or more of them for your use case. For more information about blocking public access, see Blocking public access to your Amazon S3 storage.
For the remaining settings, keep the defaults.

(Optional) If you want to configure additional bucket settings for your specific use case, see Creating a general purpose bucket.