I encountered this while trying to download a file using Lambda from S3.

For my scenario, I did the following steps:

1. Go to IAM -> Roles -> Search for Lambda's role (you can find it in Lambda -> Permissions -> Execution role -> Role name)

2. Click Add permissions -> Create inline policy

3. Choose a service -> S3

4. In the Filter Actions search bar look for GetObject -> Select the checkbox

5. In Resources click on Add ARNs in the "object" row

6. Add bucket name and the resource object name if needed - if not, select Any bucket name and/or Any object name. Click Add ARNs

7. Click Next -> Add a Policy name

8. Click Create policy