code: func NewS3ScopedReactor(reactor S3Reactor,
  	s3Bucket gocf.Stringable,
  	keyPathPrefix string,
  	additionalLambdaPermissions []sparta.IAMRolePrivilege) (*sparta.LambdaAWSInfo, error) {
  
  	reactorLambda := func(ctx context.Context, event awsLambdaEvents.S3Event) (interface{}, error) {
  		return reactor.OnS3Event(ctx, event)
  	}
  
  	// Privilege must include access to the S3 bucket for GetObjectRequest
  	lambdaFn, lambdaFnErr := sparta.NewAWSLambda(reactorName(reactor),
  		reactorLambda,
  		sparta.IAMRoleDefinition{})
  	if lambdaFnErr != nil {
  		return nil, errors.Wrapf(lambdaFnErr, "attempting to create reactor")
  	}
  
  	privileges := []sparta.IAMRolePrivilege{{
  		Actions:  []string{"s3:GetObject"},
  		Resource: spartaCF.S3AllKeysArnForBucket(s3Bucket),
  	}}
  	if len(additionalLambdaPermissions) != 0 {
  		privileges = append(privileges, additionalLambdaPermissions...)
  	}
  
  	// IAM Role privileges
  	lambdaFn.RoleDefinition.Privileges = privileges
  
  	// Event Triggers
  	lambdaFn.Permissions = append(lambdaFn.Permissions,
  		s3NotificationPrefixBasedPermission(s3Bucket, keyPathPrefix))
  
  	return lambdaFn, nil
  }
docs: // NewS3ScopedReactor returns an S3 reactor lambda function scoped to the given S3 key prefix