Question

我正在使用lambda函数的默认代码：

console.log('Loading function');

var aws = require('aws-sdk');
var s3 = new aws.S3({ apiVersion: '2006-03-01' });

exports.handler = function(event, context) {
    //console.log('Received event:', JSON.stringify(event, null, 2));

    // Get the object from the event and show its content type
    var bucket = event.Records[0].s3.bucket.name;
    var key = decodeURIComponent(event.Records[0].s3.object.key.replace(/\+/g, ' '));
    var params = {
        Bucket: bucket,
        Key: key
    };

    s3.getObject(params, function(err, data) {
        if (err) {
            console.log(err);
            var message = "Error getting object " + key + " from bucket " + bucket +
                ". Make sure they exist and your bucket is in the same region as this function.";
            console.log(message);
            context.fail(message);
        } else {
            console.log('CONTENT TYPE:', data.ContentType);
            context.succeed(data.ContentType);
        }
    });
};

但是我收到拒绝访问错误：

2016-02-24T14:21:21.503Z    kvyo1midvc2r69gm    Loading function 
START RequestId: baf9049b-db01-11e5-bc34-791df91353a9 Version: $LATEST 
2016-02-24T14:21:22.500Z    baf9049b-db01-11e5-bc34-791df91353a9    { [AccessDenied: Access Denied] message: 'Access Denied', code: 'AccessDenied', region: null, time: Wed Feb 24 2016 14:21:22 GMT+0000 (UTC), requestId: '215CD9BB4094E209', extendedRequestId: '0kDBEyMiJYbMApEqJuAtKct2SKLI7Z7tCBVyW6QJsYwMHROvtCEDynbGSsBdqbwFcX+YrSlGnsg=', statusCode: 403, retryable: false, retryDelay: 30 } 
2016-02-24T14:21:22.539Z    baf9049b-db01-11e5-bc34-791df91353a9    Error getting object {"originalFilename":"c12eaadf3d3b46d9b5ded6c078534c11","versions":[{"Size":1024,"Crop":null,"Max":false,"Rotate":0}]} from bucket xmovo.originalimages.develop. Make sure they exist and your bucket is in the same region as this function. 
2016-02-24T14:21:22.539Z    baf9049b-db01-11e5-bc34-791df91353a9
{
    "errorMessage": "Error getting object {\"originalFilename\":\"c12eaadf3d3b46d9b5ded6c078534c11\",\"versions\":[{\"Size\":1024,\"Crop\":null,\"Max\":false,\"Rotate\":0}]} from bucket xmovo.originalimages.develop. Make sure they exist and your bucket is in the same region as this function."
}
END RequestId: baf9049b-db01-11e5-bc34-791df91353a9 
REPORT RequestId: baf9049b-db01-11e5-bc34-791df91353a9  Duration: 723.44 ms Billed Duration: 800 ms Memory Size: 128 MB Max Memory Used: 34 MB

我的lambda函数和我的S3存储桶位于同一区域'US Standart'和'us-east-1'，它们是相同的

对lambda函数的IAM权限是正确的，允许GetObject Action，（使用创建lambda函数的向导设置）

所有检查我不知道为什么我仍然得到访问被拒绝错误

提前致谢

Answer 1

查看日志输出，我可以看到key变量包含以下字符串：

{\"originalFilename\":\"c12eaadf3d3b46d9b5ded6c078534c11\",\"versions\":[{\"Size\":1024,\"Crop\":null,\"Max\":false,\"Rotate\":0}]}

我猜你打算让那个变量包含字符串"c12eaadf3d3b46d9b5ded6c078534c11"。

如果您没有访问权限，或者密钥不存在，S3将返回403错误响应。在这两种情况下返回“拒绝访问”是一种安全功能，可以防止攻击者找到存储桶中实际存在的密钥。

我认为您需要更改此行：

decodeURIComponent(event.Records[0].s3.object.key.replace(/\+/g, ' '));

这样的事情：

decodeURIComponent(event.Records[0].s3.object.key.originalFilename.replace(/\+/g, ' '));

Answer 2

检查您要使用的角色的IAM权限，可能deny权限高于allow权限。

当来自S3存储桶的getObject时，aws lambda函数的访问被拒绝

2 个答案: