Question

我尝试使用Lambda函数来触发Elastic Transcoder作业，但我不断收到此错误消息：

AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/xxxx/xxx is not authorized to perform: elastictranscoder:CreateJob on resource: arn:aws:elastictranscoder:xxxxx:pipeline/xxxxx

我的IAM用户政策涵盖了所有访问要求：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1465486106000",
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:GetLogEvents",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
        ],
        "Resource": [
            "arn:aws:logs:*:*:*"
        ]
    },
    {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
            "s3:Put*",
            "s3:ListBucket",
            "s3:*MultipartUpload*",
            "s3:Get*"
        ],
        "Resource": "*"
    },
    {
        "Sid": "2",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "*"
    },
    {
        "Sid": "3",
        "Effect": "Deny",
        "Action": [
            "s3:*Delete*",
            "s3:*Policy*",
            "sns:*Remove*",
            "sns:*Delete*",
            "sns:*Permission*"
        ],
        "Resource": "*"
    }
]
}

为什么我会收到AccessDeniedException以及如何解决？

Answer 1

将您的政策更改为以下内容，然后尝试将其运作

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1465486106000",
        "Effect": "Allow",
        "Action": [

            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:GetLogEvents",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
        ],
        "Resource": [
            "arn:aws:logs:*:*:*"
        ]
    },
    {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
            "elastictranscoder:*",
            "s3:Put*",
            "s3:ListBucket",
            "s3:*MultipartUpload*",
            "s3:Get*"
        ],
        "Resource": "*"
    },
    {
        "Sid": "2",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "*"
    },
    {
        "Sid": "3",
        "Effect": "Deny",
        "Action": [
            "s3:*Delete*",
            "s3:*Policy*",
            "sns:*Remove*",
            "sns:*Delete*",
            "sns:*Permission*"
        ],
        "Resource": "*"
    }
]
}

Answer 2

你不需要通过编辑来改变json。首先检测您要编辑的角色？

1-) Click Permisson http://prntscr.com/j1giww 
2-) see the role name http://prntscr.com/j1gj6s 
3-) go to IAM Roles 
4-) select the roles that you see at step 2
5-) edit policy and add Transcoder Full Access ( Or selected access )

AWS AccessDeniedException elastictranscoder：CreateJob

2 个答案: