Question

我完全遵循了你在https://github.com/arithmetric/aws-lambda-ses-forwarder上所说的内容，但我被卡住了。没有任何谷歌搜索或没有玩选项也有帮助。客户即将终止合同 - 我们已经坚持这个错误太久了。

我已经验证了我的域名。我可以通过我的验证地址从任何地方收到电子邮件到指定的S3存储桶。我还更改了＆＃39;＆＃34; functionArn＆＃34;：xxx ...＆＃34;＆＃39; to＆＃39;＆＃34; functionArn＆＃34;：＆＃34; arn：aws：lambda：us-west-2：MY-ACCOUNT-ID：function：fnForwardEmailToGmail＆＃34;＆＃39;。

然而，收到的电子邮件永远不会被转发，当我使用＆＃34; SES电子邮件接收＆＃34;来测试功能时我收到以下错误。

START RequestId: 7f2cd5ed-83ea-11e7-913f-55748388c69f Version: $LATEST
2017-08-18T07:54:44.467Z    7f2cd5ed-83ea-11e7-913f-55748388c69f    { level: 'info',
  message: 'Fetching email at s3://MY-S3-BUCKET/MY-PREFIX/o3vrnil0e2ic28fgfdstrm7dfhrc2v0clambda4nbp0g1' }
2017-08-18T07:54:46.068Z    7f2cd5ed-83ea-11e7-913f-55748388c69f    { level: 'error',
  message: 'copyObject() returned error:',
  error: 
   { [AccessDenied: Access Denied]
     message: 'Access Denied',
     code: 'AccessDenied',
     region: null,
     time: Fri Aug 18 2017 07:54:46 GMT+0000 (UTC),
     requestId: 'A6285517D1AF2B9D',
     extendedRequestId: 'dfH3csS5kHLsYN4ZgIWVliYmuVb1OgCVl6KdUSdZdqwX2T+JdkfZwIyPa5KEgYFiJfZmrwXjXDI=',
     cfId: undefined,
     statusCode: 403,
     retryable: false,
     retryDelay: 32.49475641641766 },
  stack: 'AccessDenied: Access Denied
    at Request.extractError (/var/task/node_modules/aws-sdk/lib/services/s3.js:473:35)
    at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:105:20)
    at Request.emit (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
    at Request.emit (/var/task/node_modules/aws-sdk/lib/request.js:615:14)
    at Request.transition (/var/task/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/var/task/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /var/task/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/var/task/node_modules/aws-sdk/lib/request.js:38:9)
    at Request.<anonymous> (/var/task/node_modules/aws-sdk/lib/request.js:617:12)
    at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:115:18)' }
2017-08-18T07:54:46.127Z    7f2cd5ed-83ea-11e7-913f-55748388c69f    {"errorMessage":"Error: Could not make readable copy of email."}
END RequestId: 7f2cd5ed-83ea-11e7-913f-55748388c69f
REPORT RequestId: 7f2cd5ed-83ea-11e7-913f-55748388c69f  Duration: 1993.85 ms    Billed Duration: 2000 ms    Memory Size: 128 MB Max Memory Used: 32 MB

LAMBDA角色职能政策

{
    "Version": "2016-03-04",
    "Statement": [
       {
          "Effect": "Allow",
          "Action": [
             "logs:CreateLogGroup",
             "logs:CreateLogStream",
             "logs:PutLogEvents"
          ],
          "Resource": "arn:aws:logs:*:*:*"
       },
       {
          "Effect": "Allow",
          "Action": "ses:SendRawEmail",
          "Resource": "*"
       },
       {
          "Effect": "Allow",
          "Action": [
             "s3:GetObject",
             "s3:PutObject"
          ],
          "Resource": "arn:aws:s3:::MY-S3-BUCKET/*"
       }
    ]
}

我已经为我的LAMBDA ROLE添加了两个托管角色＆＃34; AmazonS3FullAccess＆＃34;和＃34; AmazonSESFullAccess＆＃34;。

S3 BUCKET POLICY

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "GiveSESPermissionToWriteEmail",
         "Effect": "Allow",
         "Principal": {
            "Service": "ses.amazonaws.com"
         },
         "Action": "s3:PutObject",
         "Resource": "arn:aws:s3:::MY-S3-BUCKET/*",
         "Condition": {
            "StringEquals": {
               "aws:Referer": "MY-ACCOUNT-ID"
            }
         }
      }
   ]
}

我哪里错了？请帮助！

Answer 1

copyObject()调用似乎是在S3中复制文件。您应该为您的角色添加S3权限。

Answer 2

我遇到了同样的问题。在这里查看了GitHub设置说明https://github.com/arithmetric/aws-lambda-ses-forwarder#set-up之后，我注意到我的S3的IAM策略没有任何权限设置。

S3服务应具有“限制：读取，写入”访问级别。

您需要修改策略并确保最后有一个“/ *”。见下面的例子：

"Resource": "arn:aws:s3:::S3-BUCKET-NAME/*"

AWS Lambda + S3 + SES + Gmail转发：＆＃39; copyObject（）返回错误：＆＃39;

2 个答案: