amazon web services - How to create a folder in AWS S3 using AWS Lambda for a user authenticated by Cognito -

i trying invoke lambda function creates aws resources (s3 folder , dynamodb item) authenticated users. lambda function invoked client side after user logged in through aws cognito.

making s3 putobject request client-side works fine. however, if make same request invoked lambda function, fails.

client --> s3 --> works client --> lambda --> s3 --> not work 

here lambda function:

s3 = boto3.resource('s3') bucket = s3.bucket('bucket_name') id = str(context.identity.cognito_identity_id) bucket.put_object(key='cognito/users/{}/'.format(id)) 

i following error

clienterror: error occurred (accessdenied) when calling putobject operation:  access denied 

both cognito authenticated role , lambda role pointing same role:

{     "version": "2012-10-17",     "statement": [         {             "action": ["lambda:invokefunction"],             "effect": "allow",             "resource": "arn:aws:lambda:us-east-1:account_id:function:createresources"         },         {             "effect": "allow",             "action": ["s3:listbucket"],             "resource": ["arn:aws:s3:::bucket_name"],             "condition": {                 "stringlike": {                     "s3:prefix": ["cognito/users/${cognito-identity.amazonaws.com:sub}/*"]                 }             }         },         {             "effect": "allow",             "action": [                 "s3:getobject",                 "s3:putobject",                 "s3:deleteobject"             ],             "resource": [                 "arn:aws:s3:::bucket_name/cognito/users/${cognito-identity.amazonaws.com:sub}",                 "arn:aws:s3:::bucket_name/cognito/users/${cognito-identity.amazonaws.com:sub}/*"             ]         }     ] } 

and trust relationship:

{   "version": "2012-10-17",   "statement": [     {       "effect": "allow",       "principal": {         "federated": "cognito-identity.amazonaws.com"       },       "action": "sts:assumerolewithwebidentity",       "condition": {         "stringequals": {           "cognito-identity.amazonaws.com:aud": "us-east-1:identity_pool_id"         },         "foranyvalue:stringlike": {           "cognito-identity.amazonaws.com:amr": "authenticated"         }       }     },     {       "effect": "allow",       "principal": {         "service": "lambda.amazonaws.com"       },       "action": [         "sts:assumerole",         "sts:assumerolewithwebidentity"       ]     }   ] } 

how can achieve or there better way this?