Question

我不确定我是否获得正确的权限，但是我试图在我的lambda函数中使用listObjectsV2，但得到access denied error。我正在使用无服务器。

这是我的iAMRoleStatement

 iamRoleStatements:
    - Effect: "Allow"
      Action:
        - s3:GetObject
        - s3:ListBucket
      Resource: 
        - "arn:aws:s3:::${self:custom.bucket1}/*"
        - "arn:aws:s3:::${self:custom.bucket2}/*"

它给了我这个回应：

{
    "errorMessage": "Access Denied",
    "errorType": "AccessDenied",
    "stackTrace": [
        "Request.extractError (/var/runtime/node_modules/aws-sdk/lib/services/s3.js:577:35)",
        "Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20)",
        "Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10)",
        "Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14)",
        "Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)",
        "AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)",
        "/var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10",
        "Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)",
        "Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12)",
        "Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18)"
    ]
}

这是函数

const AWS = require('aws-sdk')
const apiVersion = '2006-03-01'

module.exports.index = async (event, context) => {
  const s3 = new AWS.S3({ apiVersion })
  const { path: { bucket_name } } = event
  const params = {
    Bucket: 'ml-chips-result'
  }

  return new Promise((resolve, reject) => {
    s3.listObjectsV2(params, (err, data) => {
      if (err) reject(err)
      else resolve(data)
    })
  })
  .then(data => {
    return {
      data,
      event
    }
  })
}

根据我在文档中找到的示例，正确的permission是ListBuckets。但这似乎不起作用。

Answer 1

也尝试为ListBuckets添加权限来访问存储桶的根：

  Resource: 
    - "arn:aws:s3:::${self:custom.bucket1}"
    - "arn:aws:s3:::${self:custom.bucket1}/*"
    - "arn:aws:s3:::${self:custom.bucket2}"
    - "arn:aws:s3:::${self:custom.bucket2}/*"

ListObjectV2获取AWS Lambda中的访问被拒绝错误

1 个答案: