Nodejs adm-zip fails in Lambda with Access Denied Error - node.js

Question

My goal is to read a file inside a zip file from Lambda which is called by S3 Put, here is the code, but it fails Access Denied, even though Lambda has full access to S3:
var AWS = require('aws-sdk');
var fs = require('fs');
var s3 = new AWS.S3();
var AdmZip = require('adm-zip');
exports.handler = function(event, context, callback) {
const bucket = event.Records[0].s3.bucket.name;
const key = event.Records[0].s3.object.key;
var params = {Bucket: 'bucket', Key: 'key'};
console.log('Bucket Name:', bucket);
console.log('Object Name:', key);
var buffer = s3.getObject(params).createReadStream();
var zip = new AdmZip(buffer);
var zipEntries = zip.getEntries();
zipEntries.forEach(function(zipEntry) {
console.log(zipEntry.toString());
console.log('File Name: ',zipEntry.entryName);
if (zipEntry.entryName == "text.txt") {
console.log(zipEntry.data.toString('utf8'));
}
});
};
I am getting the following error:
START RequestId: fc524797-4d28-11e6-a092-5b3299c063a6 Version: $LATEST
2016-07-18T20:48:33.983Z fc524797-4d28-11e6-a092-5b3299c063a6 Bucket Name: myTestBucket123
2016-07-18T20:48:33.984Z fc524797-4d28-11e6-a092-5b3299c063a6 Object Name: test.zip
2016-07-18T20:48:35.145Z fc524797-4d28-11e6-a092-5b3299c063a6 AccessDenied: Access Denied
at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/services/s3.js:524:35)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20)
at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:615:14)
at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)
at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)
at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10
at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)
at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:617:12)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18)
END RequestId: fc524797-4d28-11e6-a092-5b3299c063a6
REPORT RequestId: fc524797-4d28-11e6-a092-5b3299c063a6 Duration: 4318.87 ms Billed Duration: 4400 ms Memory Size: 128 MB Max Memory Used: 24 MB
Process exited before completing request
Here is the policy for the role that Lambda is using:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
}