Question

我正在尝试使用导入的库在Python中执行Lambda脚本，但是我收到了权限错误。我也收到一些关于数据库的警报，但是在子进程之后调用数据库查询，所以我不认为它们是相关的。有人可以解释我为什么会收到错误吗？

警报信息

Alarm:Database-WriteCapacityUnitsLimit-BasicAlarm 
State changed to INSUFFICIENT_DATA at 2016/08/16. Reason: Unchecked: Initial alarm creation

Lambda错误

[Errno 13] Permission denied: OSError Traceback (most recent call last):File "/var/task/lambda_function.py", line 36, in lambda_handler     
xml_output = subprocess.check_output(["./mediainfo", "--full", "--output=XML", signed_url]) 
File "/usr/lib64/python2.7/subprocess.py", line 566, in check_output process = Popen(stdout=PIPE, *popenargs, **kwargs)
File "/usr/lib64/python2.7/subprocess.py", line 710, in __init__ errread, errwrite) File "/usr/lib64/python2.7/subprocess.py", line 1335, in _execute_child raise child_exception 
OSError: [Errno 13] Permission denied

Lambda代码

import logging
import subprocess

import boto3

SIGNED_URL_EXPIRATION = 300     # The number of seconds that the Signed URL is valid
DYNAMODB_TABLE_NAME = "TechnicalMetadata"
DYNAMO = boto3.resource("dynamodb")
TABLE = DYNAMO.Table(DYNAMODB_TABLE_NAME)

logger = logging.getLogger('boto3')
logger.setLevel(logging.INFO)


def lambda_handler(event, context):
    """

    :param event:
    :param context:
    """
    # Loop through records provided by S3 Event trigger
    for s3_record in event['Records']:
        logger.info("Working on new s3_record...")
        # Extract the Key and Bucket names for the asset uploaded to S3
        key = s3_record['s3']['object']['key']
        bucket = s3_record['s3']['bucket']['name']
        logger.info("Bucket: {} \t Key: {}".format(bucket, key))
        # Generate a signed URL for the uploaded asset
        signed_url = get_signed_url(SIGNED_URL_EXPIRATION, bucket, key)
        logger.info("Signed URL: {}".format(signed_url))
        # Launch MediaInfo
        # Pass the signed URL of the uploaded asset to MediaInfo as an input
        # MediaInfo will extract the technical metadata from the asset
        # The extracted metadata will be outputted in XML format and
        # stored in the variable xml_output
        xml_output = subprocess.check_output(["./mediainfo", "--full", "--output=XML", signed_url])
        logger.info("Output: {}".format(xml_output))
        save_record(key, xml_output)

def save_record(key, xml_output):
    """
    Save record to DynamoDB

    :param key:         S3 Key Name
    :param xml_output:  Technical Metadata in XML Format
    :return:
    """
    logger.info("Saving record to DynamoDB...")
    TABLE.put_item(
       Item={
            'keyName': key,
            'technicalMetadata': xml_output
        }
    )
    logger.info("Saved record to DynamoDB")


def get_signed_url(expires_in, bucket, obj):
    """
    Generate a signed URL
    :param expires_in:  URL Expiration time in seconds
    :param bucket:
    :param obj:         S3 Key name
    :return:            Signed URL
    """
    s3_cli = boto3.client("s3")
    presigned_url = s3_cli.generate_presigned_url('get_object', Params={'Bucket': bucket, 'Key': obj},
                                                  ExpiresIn=expires_in)
    return presigned_url

Answer 1

我相当确定这是lambda执行环境所施加的限制，但可以通过shell执行脚本来解决这个问题。
尝试为您的子进程调用提供shell = True：

xml_output = subprocess.check_output(["./mediainfo", "--full", "--output=XML", signed_url], shell=True)

Answer 2

我遇到了类似的情况。我收到了错误：

2016-11-28T01:49:01.304Z    d4505c71-b50c-11e6-b0a1-65eecf2623cd    Error: Command failed: /var/task/node_modules/youtube-dl/bin/youtube-dl --dump-json -f best https://soundcloud.com/bla/blabla
python: can't open file '/var/task/node_modules/youtube-dl/bin/youtube-dl': [Errno 13] Permission denied

对于包含第三方库的我（和其他所有）Node Lambda项目，将有一个名为＆＃34; node_modules＆＃34;的目录。（大多数教程，such as this one将详细说明如何创建此目录），其中包含所有第三方软件包及其依赖项。相同的原则适用于其他支持的语言（目前是Python和Java）。 这些是亚马逊实际上在LAMBDA AMIS上使用并试图使用的文件。因此，要解决此问题，请在node_modules目录（或您的第三方库所在的任何目录）上运行此命令：

chmod -R 777 /Users/bla/bla/bla/lambdaproject/node_modules

此命令意味着使文件可读，可写并由所有用户执行。显然，执行Lambda函数的服务器需要哪些才能工作。希望这有帮助！

AWS - OS错误权限被拒绝Lambda脚本

2 个答案: