Yeah it's an Event Notification that triggers lambda that acts on the bucket, i had to give it permissions to the bucket so i guess it's outside it :). We'll see!
Yeah I agree. We're currently using it to dump images as originals into a bucket at a path.. then the aws lambda function attached generates all the thumbnails.