Question

我确定我已将Lambda设置为对私有存储桶具有读/写权限;更具体地说，我的lambda将执行s3.headObject和s3.upload。为了让这个工作，我错过了什么？

我的Lambda政策：

{
"Statement": [
    {
        "Resource": "arn:aws:logs:us-east-1:*:*",
        "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
        ],
        "Effect": "Allow"
    },
    {
        "Resource": "arn:aws:s3:::PRIVATE_BUCKET/folder_name/*",
        "Action": [
            "s3:GetObject",
            "s3:PutObject"
        ],
        "Effect": "Allow"
    }
],
"Version": "2012-10-17"

}

我的S3存储策略：

 {
    "AWSTemplateFormatVersion" : "2010-09-09",
    "Description" : "Bucket that is read-accessible internally",
    "Parameters" : {
        "Environment" : {
            "Description" : "dev",
            "Type" : "String",
            "Default" : "dev",
            "AllowedValues" : [ "dev" ]
        }
    },
    "Resources" : {
        "PrivateBucket" : {
            "Type" : "AWS::S3::Bucket",
            "DeletionPolicy" : "Retain",                
        },
        "PrivateBucketPolicy" : {
            "Type" : "AWS::S3::BucketPolicy",
            "Properties" : {
                "PolicyDocument" : {
                    "Id" : "Make anonymous read-only access available on certain networks",
                    "Statement" : [
                        {
                            "Sid" : "IPAllow",
                            "Effect" : "Allow",
                            "Principal" : {
                                "AWS" : "*"
                            },
                            "Action" : [
                                "s3:ListBucket",
                                "s3:GetObject"
                            ],
                            "Resource" : [
                                { "Fn::Join" : [ "", [ "arn:aws:s3:::", { "Ref" : "PrivateBucket" } ] ] },
                                { "Fn::Join" : [ "", [ "arn:aws:s3:::", { "Ref" : "PrivateBucket" }, "/*" ] ] }
                            ],
                            "Condition" : {
                                "IpAddress" : {
                                    "aws:SourceIp" : [
                                        "ip/cid/r",
                                        "ip/cid/r",
                                        "ip/cid/r",
                                        "ip/cid/r",
                                        "ip/cid/r"                                        
                                    ]
                                }
                            }
                        }
                    ]
                },
                "Bucket" : { "Ref" : "PrivateBucket" }
            }
        }
    }
}

Answer 1

请参阅文档http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectHEAD.html

如果您对存储桶拥有s3：ListBucket权限，则Amazon S3将返回HTTP状态代码404（＆＃34;没有此类密钥＆＃34;）错误。

如果您没有s3：ListBucket权限，Amazon S3将返回HTTP状态代码403（＆＃34;访问被拒绝＆＃34;）错误。

我的代码试图在不存在的项目上运行headobject;所以我得到的错误是＆＃34;禁止＆＃34;这是正确的，因为我没有sb桶和lambda的listbucket权限......

为什么我的无服务器Lambda无法访问S3存储桶和项目？

1 个答案: